shai-scan

shai-scan Zero-dependency CLI scanner for npm and PyPI supply chain compromises. Why? On May 11, 2026, a self-propagating supply chain worm dubbed Mini Shai-Hulud CVE-2026-45321, GHSA-g7cv-rxg3-hmpx compromised the npm ecosystem. Attributed to TeamPCP aka DeadCatx3, PCPcat, ShellForce, CipherForc...