What problem does it solve? When a developer suspects their machine was compromised — by a supply chain attack, a malicious npm package, or a poisoned application update — they need a systematic way to check for exposed credentials, backdoors, and indicators of compromise, plus a prioritized plan for rotating secrets before attackers use them. ## Core Features & Use Cases - Supply Chain IoC Detection: Dispatches against a case library of known incidents (e.g., Apifox CDN poisoning, axios npm compromise) with per-case detection commands, interpretation guides, and cleanup procedures. - Credential Exposure Scan: Checks 20+ categories of sensitive files including AWS/GCP/Azure credentials, SSH keys, GitHub/GitLab tokens, npm tokens, crypto wallets, shell history, and .env files, with severity classification and redacted output. - Persistence & Backdoor Check: Audits LaunchAgents, cron jobs, systemd services, and suspicious binaries to detect attacker persistence mechanisms. - Prioritized Remediation Plan: Generates a severity-ranked report saved to a secure temp file, with tiered action plans from immediate crypto wallet protection to 30-day post-incident monitoring. - Use Case: After hearing about the axios npm supply chain attack, run this audit to scan all project lockfiles for compromised versions, check for RAT artifacts, and get a credential rotation checklist if compromise is confirmed. ## Quick Start Run a full security audit of my development machine to check for exposed credentials and signs of supply chain compromise.
