Eric Boehs ericboehs

Shai-Hulud Detector - PowerShell Edition

A PowerShell-based security scanner that detects indicators of compromise (IOCs) from the Shai-Hulud npm supply chain attacks that occurred in September 2025 and November 2025. This tool specifically targets the "Shai-Hulud: The Second Coming" attack that used fake Bun runtime installations to harvest credentials.

Summary

This Markdown pattern shows how to create an annotated summary that links directly to detailed items in a list.

It works by giving each list item a unique HTML anchor ID (<a id="..."></a>) and then referencing those IDs in the summary with clickable links.

The result is a compact, easy-to-scan summary where readers can jump straight to the full details of any item — useful for documentation, research notes, meeting summaries, or AI-generated outlines.

Prompt

Can you give me a list of 20 things and then summarize those 20 things in 3 sentences but links back to each of the 20 items in your summary as annotations?

	#!/usr/bin/env bash
	set -euo pipefail

	VERSION="2.11.0"
	SCRIPT_NAME="slack"

	# XDG Base Directory support
	CONFIG_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/slack-cli"
	CACHE_DIR="${XDG_CACHE_HOME:-$HOME/.cache}/slack-cli"
	TOKENS_FILE="$CONFIG_DIR/tokens.json"

	#!/usr/bin/env bash
	set -euo pipefail

	VERSION="1.1.0"
	SCRIPT_NAME="slack-status"

	# XDG Base Directory support
	CONFIG_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/slack-status"
	TOKENS_FILE="$CONFIG_DIR/tokens.json"
	TOKENS_FILE_ENCRYPTED="$CONFIG_DIR/tokens.age"

	#!/usr/bin/env node

	const WebSocket = require('ws');
	const http = require('http');

	// Default ports to try for device discovery
	const DEVICE_LIST_PORTS = [9221, 9100];

	// Parse CLI arguments
	const args = process.argv.slice(2);

	#!/usr/bin/env bash
	set -euo pipefail

	# pbcopy-decrypt - Decrypt age-encrypted clipboard contents

	usage() {
	cat >&2 <<EOF
	Usage: pbcopy-decrypt [OPTIONS]

	Decrypt age-encrypted clipboard contents using an SSH private key.

	#!/bin/bash
	#
	# Shai-Hulud 2.0 Full Machine Scanner
	# ====================================
	#
	# Scans your machine for signs of the Shai-Hulud npm supply chain attack
	# (November 2025). This attack compromised 796+ npm packages affecting
	# 20+ million weekly downloads.
	#
	# WHAT THIS SCRIPT DOES:

	#! /usr/bin/env bash

	set -e
	set -u
	set -o pipefail

	export CACHE_FILE="${XDG_CACHE_HOME:-$HOME/.cache}/gh-pm-list.txt"
	mkdir -p "$(dirname "$CACHE_FILE")"

	# Only refresh if cache is older than 5 minutes, missing, or empty

	#!/bin/bash
	# claude-notify - Notification handler for Claude Code hooks

	# Parse command line arguments
	sender=""
	while [[ $# -gt 0 ]]; do
	case $1 in
	--sender)
	sender="$2"
	shift 2

	#!/usr/bin/env ruby
	# frozen_string_literal: true

	# Parser for GitHub CODEOWNERS files that supports pattern matching and owner lookup
	class CodeownersParser
	def initialize(codeowners_file_path = '.github/CODEOWNERS')
	@codeowners_file_path = codeowners_file_path
	@rules = parse_codeowners_file
	end