Acrionix Shield
If you find this useful, please give it a star on GitHub — it helps others discover the project and keeps us motivated to improve it!
Pre-publish security scanner — catches source leaks, leaked secrets and known-bad dependencies across seven dependency ecosystems, plus Node.js/PHP runtime, Docker, git history and GitHub Actions checks.
Built by Acrionix Technologies in response to the Anthropic/Claude Code source leak and the axios supply chain attack of March 2026.
The Problem
On March 31, 2026, two major security incidents shook the npm ecosystem:
- Anthropic's Claude Code accidentally published a
.map file containing references to 500,000 lines of unobfuscated source code on a public cloud bucket
- axios (400M+ weekly downloads) was compromised — versions
1.14.1 and 0.30.4 injected a malicious plain-crypto-js dependency that harvested credentials
Acrionix Shield is a zero-dependency CLI that catches both types of issues before they reach production.
Quick Start
npx acrionix-shield check
That's it. No config needed.
See a real scan
This repository includes an intentionally vulnerable PHP Dockerfile. From a directory outside the Shield checkout, run:
git clone https://github.com/andrei-gogo/acrionix-shield.git
npx [email protected] scan-php --dir acrionix-shield/examples/php-runtime
Shield reports the affected runtime and the precise patch to use:
[1/1] Scanning PHP runtime and Composer dependencies...
CRITICAL (1 finding)
PHP2Shell — PHP 8.3.30 is unpatched
File: Dockerfile:1
Advisory: CVE-2026-109618, CVE-2026-109619
Fix: Upgrade to PHP 8.3.36 or later
Found 1 issue(s). Review before publishing.
The example contains no real application or secrets. See the reproduction and fix. Shield uses a finite offline advisory list; a clean scan does not replace your ecosystem's full audit tools. Coverage limits explain what it can and cannot check.
What It Scans
Source Leak Scanner
.map source map files that expose your source code.env, .pem, .key files with secrets- Cloud storage URLs (AWS S3, Google Cloud, Azure Blob, Cloudflare R2)
- Hardcoded secrets and provider keys: AWS, GitHub, npm, OpenAI, Anthropic, Slack, Stripe, SendGrid, Square, Google, and database URLs with credentials (22 provider formats, shared with the git scanner)
- Embedded private keys and certificates
- Internal file paths (
/Users/..., C:\Users\...)
sourceMappingURL references in compiled code- Missing
.npmignore or files field warnings
Supply Chain Scanner
- Known compromised packages (axios, event-stream, ua-parser-js, coa, rc, colors, faker, node-ipc, tensorlake, @subql/common, the MALFEX packages, and more)
- Typosquatting detection (catches
axois instead of axios, 1odash instead of lodash)
- Suspicious registries (packages resolved from non-standard URLs)
- Missing integrity hashes in lockfiles
- Supports
package-lock.json, classic Yarn v1 yarn.lock, and pnpm-lock.yaml (Yarn Berry lockfiles are not parsed yet)
- Every installed copy is checked, so a safe nested copy cannot hide a vulnerable top-level one
- Registry URLs in findings are shown as scheme, host and path only — credentials, query string and fragment are removed
- Node.js runtime (Node2Shell, CVE-2026-111497): official
node images in Dockerfile/compose, .nvmrc, .node-version and .tool-versions are checked against the fixed releases 22.23.4, 24.22.1 and 26.12.1. Lines before 22 and odd lines (23, 25) are end-of-life. Floating tags such as node:22 or node:lts are reported as unverified, because the patch level depends on when the image was pulled. engines.node ranges are not evaluated.
Dependency Ecosystems
Offline, curated rules for seven dependency ecosystems:
| Ecosystem | Files read | Checks |
|---|
| npm | package-lock.json, yarn.lock (v1), pnpm-lock.yaml | Compromised packages, typosquats, registries, integrity |
| Python / PyPI | requirements.txt, Pipfile.lock, poetry.lock, pip.conf / pip.ini | Compromised packages (incl. litellm 1.82.7/1.82.8/1.107.0), known-vulnerable ranges (Brotli/brotlicffi CVE-2026-111497, Pillow < 13.0.0), typosquats, insecure pip config |
| Java | pom.xml, build.gradle, build.gradle.kts | Curated Log4j, Spring web, Struts, Jackson and fastjson advisories, including fastjson CVE-2026-16723 |
| .NET / NuGet | .csproj, .fsproj, .vbproj, packages.config | Curated NuGet advisory ranges (log4net, Newtonsoft.Json, OData and others) |
| Ruby | Gemfile, Gemfile.lock | Curated hijacked gem releases (including rest-client 1.6.10–1.6.13), typosquats, HTTP sources |
| Go | go.mod (go.sum only without go.mod) | Curated module advisory ranges, local replace |
| PHP | Dockerfile / compose php images, .php-version, .tool-versions, composer.json, composer.lock | PHP runtime advisories (PHP2Shell), Composer TLS settings, optional custom Composer blocklist |
以上为 README 的开头部分。其余内容请阅读原文。 查看完整 README ↗
