From 3ac9cde11d19cd85f5ecbbda69baa38ae5514ff5 Mon Sep 17 00:00:00 2001 From: Obiajulu-gif Date: Mon, 19 Oct 2026 15:20:25 +0100 Subject: [PATCH] ci: add malware guard for hidden-payload worm signatures Co-Authored-By: Claude Opus 5.5 --- .github/workflows/malware-guard.yml | 33 +++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 .github/workflows/malware-guard.yml diff --git a/.github/workflows/malware-guard.yml b/.github/workflows/malware-guard.yml new file mode 100644 index 0000000..ba556a3 --- /dev/null +++ b/.github/workflows/malware-guard.yml @@ -0,0 +1,33 @@ +# Blocks the obfuscated-payload worm seen in Drips Wave repos (Sep-Oct 2026): +# code hidden after long runs of whitespace in config files, plus +# branch_structure.json / temp_*_push.bat entries added to .gitignore. +name: Malware guard + +on: + pull_request: + push: + branches: [main] + +permissions: + contents: read + +jobs: + scan: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + persist-credentials: false + - name: Scan for known payload signatures + run: | + set -u + fail=0 + check() { + hits=$(git grep -nIP "$1" -- "${@:2}" ':!.github/workflows/malware-guard.yml' ':!*lock*' ':!*.min.js' | cut -c1-200) + if [ -n "$hits" ]; then echo "::error::$1"; echo "$hits"; fail=1; fi + } + check '\S[ \t]{150,}\S|^[ \t]{150,}\S' '*.js' '*.cjs' '*.mjs' '*.ts' '*.jsx' '*.tsx' + check "global\.i\s*=\s*'|global\[['\"]!['\"]\]" '*.js' '*.cjs' '*.mjs' '*.ts' '*.jsx' '*.tsx' + check 'temp_auto_push|temp_interactive_push|branch_structure\.json' '.gitignore' '**/.gitignore' + check '"runOn"\s*:\s*"folderOpen"' '.vscode/*' + exit $fail