cve-2025-55182-scanner

The scanner does not attempt remediation; it only reports suspicious findings and returns a non-zero exit code if anything suspicious is detected.

Requirements

• Python: 3.8+ recommended
• OS: Linux or macOS

The script uses only the Python standard library; no external Python packages are required.

Basic usage

• Run from the repository root (default, human-readable output):

• Scan a specific project or root directory for JS XOR injection IoCs:

• Produce JSON output (for automation or log ingestion):

• Skip JavaScript XOR injection scanning (system-level checks only):

• Combine flags as needed:

Exit codes

• 0: No suspicious indicators were found (all checks passed).
• 1: One or more suspicious indicators were found (at least one check failed).

Typical workflows

• Quick host triage (Linux or macOS):

  • Command:
    • python3 cve_2025_55182_scanner.py
  • Use when:
    • You suspect the host may have been exploited via CVE-2025-55182 and want a fast overview of processes, filesystem, systemd, and cron IoCs.

• Application-focused scan (Next.js/React project):

  • Command:
    • python3 cve_2025_55182_scanner.py --root /path/to/app
  • Use when:
    • You want to check for malicious XOR-based JavaScript injections (e.g. in node_modules or application code) in addition to system-level IoCs.

• CI / automated environment:

  • Command:
    • python3 cve_2025_55182_scanner.py --root . --json
  • Use when:
    • You need structured JSON output for dashboards, logs, or automated decisions.

Special thanks and reference

• Incident report and IoCs:
  • This scanner’s checks and indicators of compromise are heavily based on the detailed public incident report by Asleepace:
  • https://asleepace.com/blog/malware-cve-2025-55182-exploitation-incident-report

Special thanks to Asleepace for documenting the CVE-2025-55182 exploitation and associated malware behaviors in depth, which made it possible to build this focused scanner.