Supply-Chain Lockdown — claude-jacked

Executive Summary

claude-jacked is published to PyPI, used as a developer-tool dependency, and ships behavioral rules + hooks that Claude Code installs into users' shells. That blast radius makes the publish pipeline the highest-value target in this repo. The pipeline currently passes core dependency-integrity checks (uv.lock has SHA-256 hashes; pip-audit reports zero vulnerabilities; PyPI Trusted Publishers eliminates long-lived PYPI_API_TOKEN exposure), but four high-risk patterns remain:

1. Publisher action pypa/gh-action-pypi-publish is tag-pinned, not SHA-pinned — a tag-mutation attack (tj-actions class) would publish poisoned wheels to PyPI under claude-jacked's name.
2. No step-security/harden-runner egress filtering — a compromised dep installed during build could exfil to anywhere unobserved.
3. No persist-credentials: false on checkout — GITHUB_TOKEN persists in .git/config and the artifact upload step uploads dist/ only (low actual risk) but the pattern is still wrong.
4. Workflow-level id-token: write is overly broad — should be on the publish job only, not the build job.

None of these have been exploited here; all are pre-emptive. The audit also flags a number of monitoring gaps (Dependabot, SBOM, pre-commit secret scanning, in-CI workflow lint) that have not caused harm but would catch future regressions. /lockdown fix can apply most of these as low-risk auto-fixes.

Score & Posture

Category Breakdown

Per-category status — where to focus, vs. the overall number above.

Ecosystem Inventory

Findings

uses: pypa/gh-action-pypi-publish@release/v1

uses: actions/checkout@v4
uses: actions/setup-python@v5
uses: actions/upload-artifact@v4
uses: actions/download-artifact@v4

permissions:
  contents: read
  id-token: write

permissions: { contents: read }   # workflow default

jobs:
  build:
    permissions: { contents: read }
    ...
  publish:
    permissions: { id-token: write, contents: read }
    ...

- uses: step-security/harden-runner@<sha> # v2.17.0
  with:
    egress-policy: audit
    disable-sudo: true

- uses: actions/checkout@<sha> # v4.2.2
  with:
    persist-credentials: false

- name: Generate SBOM
  run: |
    uv tool install cyclonedx-bom
    cyclonedx-py environment -o sbom.cdx.json
- uses: actions/upload-artifact@<sha>
  with: { name: sbom, path: sbom.cdx.json }

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "pip"
    directory: "/"
    schedule: { interval: "weekly" }
    cooldown: { default-days: 7, semver-patch-days: 3 }
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule: { interval: "weekly" }
    cooldown: { default-days: 7 }

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.21.2
    hooks: [{ id: gitleaks }]
  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.5.0
    hooks: [{ id: detect-secrets, args: ['--baseline', '.secrets.baseline'] }]
  - repo: https://github.com/rhysd/actionlint
    rev: v1.7.7
    hooks: [{ id: actionlint }]
  - repo: https://github.com/zizmorcore/zizmor-pre-commit
    rev: v1.25.2
    hooks: [{ id: zizmor }]

brew install osv-scanner gitleaks trivy
curl -fsSL https://socket.dev/install.sh | sh
go install github.com/ossf/scorecard/v5@latest

Remediation Plan

Run /lockdown fix to apply the auto-fixable items below interactively. Each becomes its own commit.

Auto-fixable (run /lockdown fix)

• SCSC-001 — pin pypa/gh-action-pypi-publish to SHA
• SCSC-002 — pin all actions/* uses to SHAs
• SCSC-003 — move id-token: write to publish job only
• SCSC-004 — add step-security/harden-runner (audit mode) to both jobs
• SCSC-005 — add persist-credentials: false to actions/checkout
• SCSC-006 — add CycloneDX SBOM generation to release build
• SCSC-007 — create .github/dependabot.yml with 7-day cooldown
• SCSC-008 — create .pre-commit-config.yaml (gitleaks, detect-secrets, actionlint, zizmor)

Run /lockdown baseline

• SCSC-009 — generate .github/workflows/lockdown.yml (CI scanner workflow)

User installs locally

• SCSC-010 — install osv-scanner, gitleaks, socket, scorecard, trivy

Estimated post-fix score: ~92 (Hardened) — assumes all auto-fixable items applied and baseline workflow added.

Manual Verification (require gh admin scope or human eyes)

1. GitHub org → Settings → Actions → General: "Workflow permissions" set to Read repository contents and packages permissions. Uncheck "Allow GitHub Actions to create and approve pull requests."
2. GitHub org → Settings → Actions → General → Policies: enable "Require actions to be pinned to a full-length commit SHA".
3. GitHub org → Code security: enable Secret Scanning + Push Protection.
4. Repo → Settings → Rules → Rulesets for master: require signed commits, PR with 1 reviewer, dismiss stale, required status checks (add the new lockdown workflow once it's running), block force-push, linear history.
5. Repo → Settings → Environments: create a pypi environment with required reviewers. Move the OIDC trust scope onto the environment, not the repo.
6. PyPI maintainer accounts: confirm FIDO2 hardware-key 2FA (not TOTP) on all owners. Revoke any long-lived API tokens still present.
7. GitHub maintainer accounts: confirm WebAuthn 2FA enforced org-wide. Audit PATs and shorten lifetimes to ≤ 7 days.

HIPAA Mapping

4 of 12 HIPAA-relevant safeguards have full supply-chain coverage in this repo; 4 are partial; 4 are missing. Applying the auto-fix plan above moves Risk Analysis, Activity review, and Integrity Controls to "covered" — a 7/12 baseline. The remaining gaps require organizational process (runbooks, off-boarding, external audit), not code changes.

Sources

• tj-actions CVE-2025-30066 — NVD, Wiz analysis
• CISA alert (Shai-Hulud, Sept 2025) — cisa.gov
• PyPI Shai-Hulud impact — blog.pypi.org
• PyPI Trusted Publishers + PEP 740 attestations — blog.pypi.org
• StepSecurity Harden-Runner — github
• zizmor — github
• SHA-pinning GitHub policy GA — github changelog
• SLSA L3 with GitHub Artifact Attestations — github blog
• OpenSSF Scorecard — scorecard.dev
• HIPAA Security Rule Technical Safeguards — ecfr 164.312
• xz-utils backdoor timeline (CVE-2024-3094) — research.swtch.com

Generated by /lockdown · 2026-05-20 · re-run with /lockdown audit