edxeth/shai-hulud-open-source

How edxeth/shai-hulud-open-source works

This is a CI-oriented credential-harvesting, exfiltration, and propagation program, not a general-purpose library. Its documented workflow starts at the runtime entry point, gathers local and cloud/CI data, streams results through a collector, encrypts them for fallback-capable delivery, then uses discovered tokens for package or repository mutations. The README describes additional provider capabilities whose implementation files are absent from the supplied tree; those are represented only where a supported path exists, and uncertain internal links are omitted.

Main entry points: index.ts Runtime entry · githubSender.ts GitHub sender · base.ts Encrypt results · dispatcher.ts Sender dispatcher

Components 23

Runtime orchestration

Runtime entry src/index.ts
Result collector src/collector/collector.ts
Sender dispatcher src/dispatcher/dispatcher.ts

Credential harvesting

Filesystem scan src/providers/filesystem/filesystem.ts
Shell harvest src/providers/devtool/devtool.ts
CI runner scan src/providers/ghrunner/runner.ts
GitHub Actions scan src/providers/actions/actions.ts
AWS secrets src/providers/aws/ssm.ts
Kubernetes secrets src/providers/kubernetes/kubernetes.ts
Vault secrets
GitHub token check src/github_utils/tokenCheck.ts

Encrypted delivery

Encrypt results src/sender/base.ts
Domain sender src/sender/domain/domainSenderFactory.ts
GitHub sender src/sender/github/githubSender.ts

Propagation

npm token mutation src/mutator/npm/index.ts
npm OIDC mutation src/mutator/npmoidc/index.ts
Branch mutation src/mutator/branch/index.ts
Workflow enumeration src/providers/actions/pipeline.ts

Runtime support

Persistence daemon src/utils/daemon.ts
Runtime configuration src/utils/config.ts

Other components

CI environment
C2 endpoint
GitHub API

Connections 29

CI environment → Runtime entry: starts README.md
Runtime entry → Filesystem scan: executes src/index.ts
Runtime entry → Shell harvest: executes src/index.ts
Runtime entry → CI runner scan: executes src/index.ts
Runtime entry → npm OIDC mutation: checks target src/index.ts
Runtime entry → AWS secrets: runs providers src/index.ts
Runtime entry → Kubernetes secrets: runs providers src/index.ts
Runtime entry → Vault secrets: runs providers src/index.ts
Runtime entry → GitHub Actions scan: adds on token src/index.ts
Runtime entry → GitHub token check: validates tokens src/index.ts
Runtime entry → Result collector: ingests results src/index.ts
Runtime entry → Sender dispatcher: configures dispatch src/index.ts
Result collector → Sender dispatcher: dispatches batches src/collector/collector.ts
Sender dispatcher → Encrypt results: creates envelope src/dispatcher/dispatcher.ts
Encrypt results → Domain sender: sends through README.md
Encrypt results → GitHub sender: falls back to README.md
Domain sender → C2 endpoint: posts payload README.md
GitHub sender → GitHub API: commits payload src/sender/github/githubSender.ts
Runtime entry → GitHub sender: selects fallback src/index.ts
Runtime entry → Branch mutation: runs on token src/index.ts
Runtime entry → npm token mutation: mutates packages
npm OIDC mutation → npm token mutation: publishes package src/mutator/npmoidc/index.ts
Runtime entry → Persistence daemon: daemonizes src/index.ts
GitHub sender → Persistence daemon: installs monitor src/sender/github/githubSender.ts
GitHub Actions scan → Workflow enumeration: uses pipeline src/providers/actions/actions.ts
Workflow enumeration → GitHub API: queries repositories src/providers/actions/pipeline.ts
Branch mutation → GitHub API: mutates branches README.md
npm token mutation → GitHub API: checks token src/mutator/npm/index.ts
Runtime entry → Runtime configuration: checks environment src/index.ts

Drawn by GitDiagram on November 11, 2026 from the repository's file tree, README and source files. Read as Markdown ·