claude

wormhook

Local supply-chain malware detection for Claude Code. Matches Shai-Hulud (including OpenAPI token-monitor persistence), CanisterWorm, PolinRider JavaScript (including loaders hidden in files presented as fonts and run from editor tasks), ChainDrop, Miasma/Hades, Axios, SANDWORM_MODE, node-ipc, MemTensor sckit, SubQuery, testmetest, and TrapDoor indicators. Blocks guarded commands and human turns on findings in agent configuration, Python startup files, git hooks, project source, and dependencies. Warns on ambiguous credential-access, obfuscation, Python startup-hook, and hidden-Unicode patterns.

3 on GitHubby NoTambourine LLCv0.40.0MITupdated yesterday

Not in a marketplace yet, so it loads for one session with --plugin-dir.

Plugin wormhook in notambourine/wormhook. Commands read from the repo's manifest — yesterday.

This plugin runs code on your machine — its hooks fire automatically on events like tool use. The exact commands are listed below; read them before installing.

What it installs

Skills (1)

  • update

    Verify primary advisories and add local detection for supply-chain campaigns. Use for signature updates, new worm coverage, and campaign reviews.

Slash commands (1)

  • /wormhook:wormhook-setup

    Interactively set up wormhook's out-of-Claude scanning (CLI, git-pull audit, hourly sweep, scan roots)

Hooks (13)

  • PreToolUse

    "${CLAUDE_PLUGIN_ROOT}/scripts/wormhook.sh"

  • PostToolUse

    "${CLAUDE_PLUGIN_ROOT}/scripts/wormhook.sh"

  • UserPromptSubmit

    "${CLAUDE_PLUGIN_ROOT}/scripts/wormhook.sh"

  • SessionStart

    "${CLAUDE_PLUGIN_ROOT}/scripts/wormhook.sh"

  • SessionStart

    "${CLAUDE_PLUGIN_ROOT}/scripts/doctor/deps.sh"

  • SessionStart

    "${CLAUDE_PLUGIN_ROOT}/scripts/doctor/integrity.sh"

  • SessionStart

    "${CLAUDE_PLUGIN_ROOT}/scripts/doctor/sigage.sh"

  • SessionStart

    "${CLAUDE_PLUGIN_ROOT}/scripts/doctor/firewall.sh"

  • SessionStart

    "${CLAUDE_PLUGIN_ROOT}/scripts/doctor/coverage.sh"

  • SessionStart

    "${CLAUDE_PLUGIN_ROOT}/scripts/doctor/cicd.sh"

  • SessionStart

    "${CLAUDE_PLUGIN_ROOT}/scripts/doctor/drift.sh"

  • SessionStart

    "${CLAUDE_PLUGIN_ROOT}/scripts/doctor/exposure.sh"

  • SessionStart

    "${CLAUDE_PLUGIN_ROOT}/scripts/doctor/shellguard.sh"

View source on GitHub

Maintain wormhook?

This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.

claude & codex pluginslisted