False Positive for iOS

[maxie7]

It complains to the file that has no sensible information.

My output:

env \ 
  INPUT_FAIL-ON-CRITICAL=true \
  INPUT_FAIL-ON-HIGH=false \
  INPUT_FAIL-ON-ANY=false \
  INPUT_SCAN-LOCKFILES=true \
  INPUT_SCAN-NODE-MODULES=true \
  INPUT_OUTPUT-FORMAT=text \
  INPUT_WORKING-DIRECTORY=/path/to/my/app \
  node dist/index.js


Shai-Hulud 2.0 Detector
=======================
Database version: 1.0.0
Last updated: 2025-11-24T19:34:59.871Z
Total known affected packages: 790

Scanning directory: /my/app
Starting scan...

======================================================================
  SHAI-HULUD 2.0 SUPPLY CHAIN ATTACK DETECTOR
======================================================================

  STATUS: AFFECTED - 3 security finding(s)

----------------------------------------------------------------------
  SECURITY FINDINGS:
----------------------------------------------------------------------

  CRITICAL (3):
    [CRITICAL] Shai-Hulud output file: Contents.json
           Type: secrets-exfiltration
           Location: .../ios/App/App/Assets.xcassets/AppIcon.appiconset/Contents.json
           Found "Contents.json" which is a known output file from the Shai-Hulud attack containing harvested credentials or environment data.
    [CRITICAL] Shai-Hulud output file: Contents.json
           Type: secrets-exfiltration
           Location: .../ios/App/App/Assets.xcassets/Contents.json
           Found "Contents.json" which is a known output file from the Shai-Hulud attack containing harvested credentials or environment data.
    [CRITICAL] Shai-Hulud output file: Contents.json
           Type: secrets-exfiltration
           Location: .../ios/App/App/Assets.xcassets/Splash.imageset/Contents.json
           Found "Contents.json" which is a known output file from the Shai-Hulud attack containing harvested credentials or environment data.

----------------------------------------------------------------------
  Files scanned: 2
  Compromised packages: 0
  Security findings: 3
  Scan time: 87ms
  Database version: 1.0.0
  Last updated: 2025-11-24T19:34:59.871Z
======================================================================

  IMMEDIATE ACTIONS REQUIRED:
  1. Do NOT run npm install until packages are updated
  2. Rotate all credentials (npm, GitHub, AWS, etc.)
  3. Check for unauthorized GitHub self-hosted runners named "SHA1HULUD"
  4. Audit GitHub repos for "Shai-Hulud: The Second Coming" description
  5. Check for actionsSecrets.json files containing stolen credentials
  6. Review package.json scripts for suspicious preinstall/postinstall hooks
  ...

All the Content.json has this content:

{
  "info" : {
    "version" : 1,
    "author" : "xcode"
  }
}

Obviously, it's a false positive.

I have a branch to solve it, but i can't push it because of permissions.

So my solution:

in src/scanner.ts add:

(1) /\/[^/]*\.xcassets\/.*\/contents\.json$/i, in EXCLUDED_PATHS

So, it has:

...

// Files/paths to exclude from scanning (detector's own source code)
const EXCLUDED_PATHS = [
  /shai-hulud.*detector/i,
  /\/src\/scanner\.(ts|js)$/i,
  /\/src\/types\.(ts|js)$/i,
  /\/src\/index\.(ts|js)$/i,
  /\/dist\/index\.js$/i,
  /\/dist\/.*\.d\.ts$/i,
  /\/[^/]*\.xcassets\/.*\/contents\.json$/i,
];

Later in the same file add this:

const isXcodeAssetContents =
              /\/[^/]+\.xcassets\/(?:.*\/)?contents\.json$/i.test(fullPath);
            if (isXcodeAssetContents) {
              continue;
            }
            

to have this:

 if (knownMaliciousFiles.includes(entry.name.toLowerCase())) {
            const isXcodeAssetContents =
              /\/[^/]+\.xcassets\/(?:.*\/)?contents\.json$/i.test(fullPath);
            if (isXcodeAssetContents) {
              continue;
            }
            findings.push({
              type: 'secrets-exfiltration',
              severity: 'critical',
              title: `Shai-Hulud output file: ${entry.name}`,
              description: `Found "${entry.name}" which is a known output file from the Shai-Hulud attack containing harvested credentials or environment data.`,
              location: fullPath,
            });
          }

After this, npm install && npm run build, and the status is clean

More Info:
Scanned App React/Ionic

[gensecai-dev]

Hi,

Thanks for the detailed report and the fix! It's a valid false positive.

If you're having permission issues pushing a branch, you can:

1. Fork the repo
2. Apply your changes to the fork
3. Open a PR from your fork to our main branch

Thanks again for catching this and taking the time to provide a solution!

[maxie7]

Thanks, I opened Pull Request

[gensecai-dev]

Hi, Thanks and it has been merged. We really appreciate the effort and contribution .

Best