DEVOP-561: seed Shai-Hulud IOC lists for org-wide daily sweep

[srt0422]

Summary

Seeds the indicator lists that the daily org-wide Indicator Of Compromise (IOC) sweep workflow (DEVOP-560) will consume.

• .github/security/ioc-packages.txt — confirmed compromised npm + PyPI package@version pairs:
  • Shai-Hulud OpenSearch wave (@opensearch-project/opensearch 3.5.3–3.8.0).
  • PyPI sdist-poisoning variants (mistralai==2.4.6, guardrails-ai==0.10.1).
  • The broader 526-package wave: CrowdStrike, TinyColor (@ctrl/*), NativeScript (@nativescript-community/*), Teselagen, ThingsFactory/Operato (@things-factory/*), rxnt-*.
• .github/security/ioc-hashes.txt — seed SHA-256 hashes from the Socket bundle.js dropper advisory. The seven sample hashes in this file are placeholders flagged inline — the runbook author must replace them with canonical hashes from the live Socket feed before DEVOP-560 ships. Inline comments document the source.
• .github/security/REFRESH.md — documents the weekly refresh cadence and PR workflow.

Why now

The sweep workflow itself (DEVOP-560) is still on the To-do list. Seeding the IOC files first means: (a) we have a place to land manual refreshes during the gap before automation goes live, and (b) DEVOP-560's PR is reviewable against real data files instead of empty stubs.

Linear

https://linear.app/alloralabs/issue/DEVOP-561

Test plan

• File-only PR; manually inspect the IOC list for typos and duplicates.
• Confirm the 7 hash placeholders are replaced with canonical Socket-feed values before the DEVOP-560 sweep workflow is merged.
• After DEVOP-560 lands, manually gh workflow run shai-hulud-sweep.yml against a known-clean repo and confirm zero false positives.

🤖 Generated with Claude Code

---

Summary by cubic

Seeds IOC package and hash lists for the org-wide Shai-Hulud daily sweep. Imports the full Datadog 2.0 snapshot and adds canonical dropper hashes; provides the data inputs for DEVOP-560 and satisfies Linear DEVOP-561.

• New Features

  • .github/security/ioc-packages.txt: confirmed ecosystem:name@version indicators including npm:@opensearch-project/opensearch 3.5.3–3.8.0, pypi:mistralai@2.4.6, pypi:guardrails-ai@0.10.1, plus seeded entries from the 526-package wave across @crowdstrike/*, @ctrl/*, @nativescript-community/*, @teselagen/*, @things-factory/*, and rxnt-*; added the full Shai‑Hulud 2.0 Datadog consolidated snapshot (795 packages, 1091 pins). Gap: only the 1.0 remainder is sourced live from the Socket feed until DEVOP-560 ships.
  • .github/security/ioc-hashes.txt: populated with canonical SHA-256s — 7x bundle.js V1–V7 from Socket and 1x setup_bun.js + 6x bun_environment.js from Datadog’s Shai-Hulud 2.0 analysis; sources and corroboration noted inline.
  • .github/security/REFRESH.md: weekly refresh cadence, the PR workflow, and a script to import/refresh the Datadog 2.0 snapshot.

• Migration

  • After DEVOP-560 lands, run shai-hulud-sweep.yml once against a known-clean repo to verify pickup.

^{Written for commit 3c55d06. Summary will update on new commits.}

[cubic-dev-ai]

cubic analysis

2 issues found across 3 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/security/ioc-hashes.txt">

<violation number="1" location=".github/security/ioc-hashes.txt:18">
P1: The file seeds placeholder SHA-256 values instead of the required known-bad hashes from the advisory.

According to linked Linear issue DEVOP-561, this should contain the canonical 7 bundle.js hashes now, not placeholders.</violation>
</file>

<file name=".github/security/ioc-packages.txt">

<violation number="1" location=".github/security/ioc-packages.txt:129">
P1: According to linked Linear issue DEVOP-561, this IOC package seed is incomplete: it intentionally stops before adding the remaining 526-wave package@version entries required by the acceptance criteria, which can cause IOC sweep false negatives.</violation>
</file>

Linked issue analysis

Linked issue: DEVOP-561: Seed ioc-packages.txt and ioc-hashes.txt in .github org repo

Status	Acceptance criteria	Notes
✅	Add `.github/security/ioc-packages.txt` containing ecosystem:name@version lines for compromised npm/PyPI releases (seed OpenSearch wave, PyPI sdist-poisoning entries, and the broader 526-package wave).	The PR adds `.github/security/ioc-packages.txt` with npm and pypi entries (OpenSearch versions, mistralai and guardrails-ai, and many seeded packages from the 526 wave). The file format matches the expected :@ lines.
⚠️	Add `.github/security/ioc-hashes.txt` seeded with the 7 known-bad SHA-256 bundle.js hashes from the Socket advisory.	The PR adds `.github/security/ioc-hashes.txt` and includes seven SHA-256-looking lines, but they are explicitly marked as placeholders and the file contains a NOTE requiring the runbook author to replace them with canonical Socket-feed values before DEVOP-560 ships. That means the hashes are present but not the required canonical values yet.
✅	Add documentation for the refresh process (how & when to update these lists).	The PR adds `.github/security/REFRESH.md` documenting weekly refresh cadence, steps to refresh packages and hashes, PR workflow, and audit trail instructions, satisfying the documentation requirement.
❌	PR merged.	Acceptance criteria require the PR to be merged. At review time the branch is present but the PR is not merged yet, so this step remains outstanding.

Architecture diagram

sequenceDiagram
    participant Admin as Security Engineer
    participant GitHub as .github Repository
    participant GHA as GitHub Actions (Sweep)
    participant Repo as Target Org Repos
    participant Socket as Socket.dev Feed

    Note over Admin,Socket: IOC Data Consumption & Refresh Flow

    Admin->>GitHub: NEW: Seed ioc-packages.txt & ioc-hashes.txt
    Admin->>GitHub: NEW: Add REFRESH.md runbook

    GHA->>GitHub: DEVOP-560: Read ioc-packages.txt
    GitHub-->>GHA: List of npm/PyPI compromised packages
    GHA->>GitHub: DEVOP-560: Read ioc-hashes.txt
    GitHub-->>GHA: List of SHA-256 dropper hashes

    loop Each repository in org
        GHA->>Repos: Scan lockfiles and vendored artifacts
        Repos-->>GHA: Dependencies and bundled files
        GHA->>GHA: CHANGED: Match against IOC packages & hashes
        alt Match found
            GHA->>GitHub: File issue or flag for security review
        else No match
            GHA->>GHA: Log clean result
        end
    end

    Note over Admin,Socket: Weekly Refresh Cycle (per REFRESH.md)

    loop Weekly (Mondays)
        Admin->>Socket: Fetch threat feed (category:supply-chain, tag:shai-hulud)
        Socket-->>Admin: Updated IOC list
        Admin->>GitHub: Open PR: security/ioc-refresh-YYYY-MM-DD
        Admin->>GitHub: Diff & append new IOC entries (never remove old)
        Admin->>GitHub: Tag @security-oncall for review
        GitHub->>GitHub: Merge after single approval
        Admin->>GHA: Trigger shai-hulud-sweep.yml manually
        GHA->>Repos: Re-run check with updated IOCs
    end

    Note over GitHub,Socket: Placeholder hashes must be replaced before DEVOP-560 ships

    Admin->>Socket: Fetch canonical SHA-256 hashes
    Socket-->>Admin: 7 verified dropper hashes
    Admin->>GitHub: Replace placeholder hashes with canonical values

Loading

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[srt0422]

Addressed in 6fcd93c. Both cubic findings are acknowledged but cannot be "fully resolved" in this PR because the canonical SHA-256 hashes only exist in the live Socket advisory feed and the full 526-package wave is sourced live, not hand-typed. The fix makes the gap fail-safe instead of fail-open:

• ioc-hashes.txt: the seven placeholder hex strings are now commented out and replaced with zero-prefixed examples that explicitly document the canonical-fetch procedure. The sweep consumer can no longer accidentally match against them.
• ioc-packages.txt: the truncation note now explicitly documents the gating dependency on the live Socket feed (DEVOP-560) and the compensating controls (Socket CLI in DEVOP-572, prefix-match suspect policy) that apply in the interim.

DEVOP-560's launch checklist gates on replacing the placeholder hashes with canonical values OR ingesting the live Socket feed before declaring the IOC sweep production-ready.

[cubic-dev-ai]

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/security/ioc-hashes.txt">

<violation number="1" location=".github/security/ioc-hashes.txt:45">
P2: Add advisory IDs to each newly added hash comment to match the documented IOC refresh requirements and preserve audit traceability.</violation>
</file>

_{Tip: Review your code locally with the cubic CLI to iterate faster.
Fix all with cubic}

[cubic-dev-ai]

P2: Add advisory IDs to each newly added hash comment to match the documented IOC refresh requirements and preserve audit traceability.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/security/ioc-hashes.txt, line 45:

<comment>Add advisory IDs to each newly added hash comment to match the documented IOC refresh requirements and preserve audit traceability.</comment>

<file context>
@@ -1,50 +1,51 @@
+# Source: Datadog Security Labs Shai-Hulud 2.0 analysis. The 2.0 wave drops two
+# files via a `preinstall` script instead of postinstall: a small loader
+# (setup_bun.js) plus an obfuscated payload (bun_environment.js, ~10MB).
+a3894003ad1d293ba96d77881ccd2071446dc3f65f434669b49b3da92421901a  # setup_bun.js
+62ee164b9b306250c1172583f138c9614139264f889fa99614903c12755468d0  # bun_environment.js
+cbb9bc5a8496243e02f3cc080efbe3e4a1430ba0671f2e43a202bf45b05479cd  # bun_environment.js
</file context>

_{Tip: Review your code locally with the cubic CLI to iterate faster.}