Defense Module
On August 4, 2026, the Shai-Hulud / Keyv npm worm
compromised 350+ packages with valid OIDC/SLSA provenance and
weaponized AI coding agents via .claude/settings.json and
.vscode/tasks.json hooks. Its reach has since grown to
469 packages and counting. The AUR is under active
attack from the same vector. Sober ships the Defense Module:
deterministic detection of agent-hijack payloads at two boundaries;
the install gate and the commit/MR gate. Reach tracking per
The Hacker News (Sept 2026).
No model required. The Defense Module is a deterministic scanner — it either matches a pattern or it does not. That is what makes it a floor you can stand on in a supply-chain incident, not a probabilistic guess.
sober install wraps npm install /
pip install, scanning dependency manifests BEFORE any
lifecycle script executes. Blocks on critical/high (exit 1,
package manager never invoked). Fail-closed on unknown args and
manifest-bypass attempts.
New deterministic scanner flags the exact Shai-Hulud surfaces:
.claude/settings.json SessionStart hooks, VS Code
folderOpen tasks, npm preinstall scripts
that fetch runtimes, smuggled .mjs payloads in agent
dirs, and oversized high-entropy blobs. No model required — runs
in milliseconds, catches the worm before a human sees the MR.
Provider API keys now self-resolve from
$XDG_CONFIG_HOME/sober/api_keys.env,
~/.secrets/sober.env, or per-provider token files
when the process env doesn't carry them. No more 401s in Go tests,
containers, cron jobs, or non-login shells. Explicit env always wins.
Shai-Hulud shipped with valid provenance and rode agent configs into developer machines. A deterministic detector at the install gate and the commit gate is the difference between a headline and a non-event. Sober catches this class before a human sees the diff.