ioc-scanner

Detection, mitigation, and reverse-engineering tooling for CVE-2026-41940 (SessionScribe): the cPanel/WHM unauthenticated session-forgery vulnerability disclosed 2026-04-28. Defense-in-depth active mitigation shim, ModSec rule pack, remote probe, on-host IOC scanner, and per-tier RE snapshot collector. GPL v2.

Supply-chain attack scanner for the agent era. Triage in 30s with `npx patient-zero`, block malicious installs before postinstall runs, or drop into CI as a GitHub Action. Covers npm + Python + MCP agent configs. Free, MIT, no signup, no telemetry.

A fast and comprehensive tool to check IoC against Theat Intels on the internet

Detect CVE-2025-54313 eslint-config-prettier supply chain attack IOCs on Windows

Read-only WordPress User Registration CVE-2026-1492 checker for hidden admins, plugin version, uploads PHP, cron, and compromise IOCs.

Host-based threat hunting tool that scans for IOCs using keyword/signature matching and behavioral/heuristic analysis

Proactive threat hunting framework with MITRE ATT&CK mapping - hunts processes, network, files, and logs

Read-only IoC scanner for the Virtualizor supply-chain compromise delivered through the August 2026 BGP hijack of 162.55.80.0/24. Detects the java-jre-update.service backdoor, attacker SSH keys and injected core files - and preserves evidence instead of deleting it.

Defensive scanner that detects the Shai-Hulud npm worm (Chaindrop) - poisoned packages, file hashes, install/IDE hooks and persistence artifacts. Python 3.9+, zero dependencies.

Read-only cPanel CVE-2026-41940 IOC detector for .sorry ransomware, Mr_Rot13 Filemanager backdoors, C2 callbacks, cron, SSH, and logs.

Read-only PowerShell scanner for the DAEMON Tools supply chain attack disclosed by Kaspersky on 2026-05-06.

Single-file bash scanner for the keyv/cacheable npm compromise — detects preinstall malware, IDE auto-run hooks and gh-token-monitor persistence. No dependencies, one YES/NO verdict.

Fast Go scanner for supply-chain compromise exposure across npm, PyPI, lockfiles, dependencies, and host IOCs. Built for incident response triage.

IOC scanner for detecting malicious IPs, domains, and hashes