@agenttrail/guard 0.1.0
Ransomware and credential theft code
“Free, local guard for Claude Code: a PreToolUse hook that allows, asks, or blocks a tool call against a curated guardrail library. No accou…”
Deletes VSS snapshots and disables boot recoveryEncoded insecure fetch runs remote code
SHA-2569c720cbf9625033d7945438c24a6a7f40a6b27283c102c0f7e916588b037f9e6
Evidence
⋯6 lines
2125 fixtures: {
2126 block: [
2127 pwsh("vssadmin delete shadows /all /quiet"),
2128 pwsh("wbadmin delete catalog -quiet"),
2129 pwsh("bcdedit /set {default} recoveryenabled no"),
2130 bash("wmic shadowcopy delete")
2131 ],
2132 allow: [
⋯5 lines
2905:25… chain",
2906 severity: "high",
2907 defaultAction: "require_approval",
2908 title: "Executing the output of a download",
2909 description: 'Holds the command-substitution spelling of remote code execution \u2014 `bash -c "$(curl \u2026)"`, `eval "$(wget \u2026)"`, and PowerShell\'s `iex (irm \u2026)`. This is the shape block-curl-pipe-to-shell cannot see, because there is no pipe. Deliberately NOT matched: `eval` of a local command, which is how direnv, ssh-agent and every shell init line work \u2014 a rule that held those would be gone by the first morning. It therefore MISSES an eval of a variable that was filled by a download two commands earlier. A quoted MENTION is not a use: a search, a `git commit -m` message, an `echo` or a `curl …
3012:60… p.sh"),
3013 bash("npx --yes prettier --write ."),
3014 bash("pnpm dlx tsx script.ts")
3015 ]
3016 }
⋯5 lines
3022 defaultAction: "require_approval",
3023 title: "Disabling TLS certificate verification",
3024 description: "Holds a command that switches off certificate verification \u2014 curl's -k/--insecure, wget's --no-check-certificate, NODE_TLS_REJECT_UNAUTHORIZED=0, git's http.sslVerify=false, pip's --trusted-host, npm's --strict-ssl=false. Each turns an encrypted channel into one anyone on the path can rewrite, which is how a dependency download becomes …
⋯6 lines
3606 fixtures: {
3607 block: [
3608 bash("aws secretsmanager get-secret-value --secret-id prod/db"),
3609 bash("vault kv get secret/app/db"),
3610 bash("kubectl get secret app-env -o yaml"),
3611 bash("gcloud secrets versions access latest --secret=db-password")
3612 ],
3613 allow: [
3614 ...mentions("aws secretsmanager get-secret-value --secret-id prod/db"),
3615 bash("aws secretsmanager list-secrets"),
3616 bash("vault status"),
3617 bash("kubectl get secrets"),
⋯9 lines
3637 `\\becho\\s+["']?\\$\\{?[a-z_]*(token|secret|password|api_key)\\b`,
3638 "\\bdocker\\s+login\\b[^|;&]*(-p|--password)\\s",
3639 "\\bcat\\s+[^|;&]*\\.netrc\\b"
3640 ]
3641 }
3642 ],
3643 none_of: [SEARCH_MENTION, GIT_TEXT_MENTION, HTTP_BODY_MENTION]
3644 },
3645 fixtures: {
3646 block: [
3647 bash("gh auth token"),
3648 bash("echo $GITHUB_TOKEN"),
3649 bash("npm token list"),
3650 bash("cat ~/.netrc")
3651 ],
3652 allow: [
⋯4 lines
No evidence locations were recorded for this file. Raw result