# FIXTURE_ONLY: test cases for check-wfx-ci-stealer (want_rc|args|expected text). All inputs are synthetic. @G@ is the
# folder of git fixtures that tests/make_git_fixtures.sh builds outside the pack at test time.
1|--dir tests/fixtures/dir_hit|FOUND: input: file .ci-x7k2m9.sh (.ci-xxxxxx.sh helper script) [THN]
1|--dir tests/fixtures/dir_hit|FOUND: input: file .github/workflows/build-audit-ab12cd.yml (build-audit-xxxxxx workflow) [THN]
1|--dir tests/fixtures/dir_hit|FOUND: input: file .github/workflows/build-audit-ab12cd.yml contains wfx payload settings (WF_CALLBACK, WF_CTOKEN or WF_TG_CHAT) [RESEARCH ONLY, not on the THN page]
1|--dir tests/fixtures/dir_hit|FOUND: input: file composer.lock locks digitalelvis/neuronai-studio 3.14.3 (malicious release; pin 3.14.1 or earlier) [THN]
1|--dir tests/fixtures/dir_hit|FOUND: input: file docs/wfx-audit.md (probe pull request file) [RESEARCH ONLY, not on the THN page]
1|--dir tests/fixtures/dir_hit|FOUND: input: file package.json has a postinstall hook that runs a .ci-xxxxxx.sh script [THN]
1|--dir tests/fixtures/dir_hit|FOUND: input: file vendor/digitalelvis/neuronai-studio/.ci-e5infq.sh (.ci-xxxxxx.sh helper script) [THN]
1|--dir tests/fixtures/dir_hit|REVIEW: input: file go.sum references github.com/onuragtas/docker-env v1.0.278 (payload is in a workflow file only; Go builds do not run it; remove this version) [THN]
1|--dir tests/fixtures/dir_hit|REVIEW: input: file go.sum references github.com/onuragtas/redock v1.0.282 (payload is in a workflow file only; Go builds do not run it; remove this version) [RESEARCH ONLY, not on the THN page]
1|--dir tests/fixtures/dir_hit|REVIEW: input: file go.sum references github.com/vkuznet/gocurl v0.0.0-20261111095532-8d5aad0cb0da
1|--dir tests/fixtures/dir_hit|VERDICT: input: INDICATORS FOUND: treat every secret, variable and cloud role this repository's workflows could reach as stolen
1|--dir tests/fixtures/dir_hit|NEXT: input: revoke the pushing account's tokens, OAuth grants, SSH keys and sessions and turn on 2FA
1|--dir tests/fixtures/dir_hit|RESULT: INDICATORS FOUND
0|--dir tests/fixtures/dir_clean|VERDICT: input: NO INDICATORS FOUND in what was scanned. This is not proof: the attacker reverts commits and deletes workflow runs
0|--dir tests/fixtures/dir_empty|RESULT: NO INDICATORS FOUND
5|--dir tests/fixtures/dir_go_only|REVIEW: input: file go.mod references github.com/vkuznet/gocurl v0.0.0-20261111095532-8d5aad0cb0da (payload is in a workflow file only; Go builds do not run it; remove this version) [THN]
5|--dir tests/fixtures/dir_go_only|VERDICT: input: REVIEW: weak or pattern matches only
1|--dir tests/fixtures/dir_lock_3142|locks digitalelvis/neuronai-studio 3.14.2 (flagged as malware by Packagist; October wave files; pin 3.14.1 or earlier) [OURS]
1|--dir tests/fixtures/dir_lock_3144|locks digitalelvis/neuronai-studio 3.14.4 (released 12 Nov 07:50 UTC with a .ci-xxxxxx.sh postinstall stealer; pin 3.14.1 or earlier) [OURS]
1|--dir tests/fixtures/dir_hash --extra-sha256 5F799B4ED17012B2D4C2FE1EC84BE1C65C10A3D742E7DF97D933645DB0C83855|FOUND: input: file tools/payload.sh has SHA-256 5f799b4ed17012b2... (extra hash you supplied) [OPERATOR]
0|--dir tests/fixtures/dir_hash|RESULT: NO INDICATORS FOUND
1|--dir tests/fixtures/dir_extra_ip --extra-ip 198.51.100.7|FOUND: input: file .github/workflows/deploy.yml contains extra address 198.51.100.7 [OPERATOR]
0|--dir tests/fixtures/dir_extra_ip --extra-ip 203.0.113.9|RESULT: NO INDICATORS FOUND
1|--dir tests/fixtures/dir_weird|FOUND: input: file caf?/.ci-q1w2e3.sh (.ci-xxxxxx.sh helper script) [THN]
1|--dir tests/fixtures/dir_weird|FOUND: input: file my app/.github/workflows/build-audit-zz99yy.yml (build-audit-xxxxxx workflow) [THN]
1|--dir tests/fixtures/dir_depth|FOUND: input: file d1/d2/d3/d4/d5/d6/d7/d8/d9/d10/d11/.ci-depth1.sh (.ci-xxxxxx.sh helper script) [THN]
1|--entra-json tests/fixtures/entra_hit.json|FOUND: input: Entra federated identity credential wfx-ci-1 (wfx-ci- prefix) [THN]
1|--entra-json tests/fixtures/entra_hit.json|FOUND: input: Entra federated identity credential wfx-ci-2 (wfx-ci- prefix) [THN]
1|--entra-json tests/fixtures/entra_hit.json|NOTE: input: 3 federated identity credentials in the Entra export trust the GitHub OIDC issuer; confirm each one is yours and scoped to one repository and branch (OUR ADVICE)
1|--entra-json tests/fixtures/entra_crlf.json|FOUND: input: Entra federated identity credential wfx-ci-crlf (wfx-ci- prefix) [THN]
0|--entra-json tests/fixtures/entra_clean.json|NOTE: input: 1 federated identity credentials in the Entra export trust the GitHub OIDC issuer
0|--entra-json tests/fixtures/entra_none.json|NOTE: input: no federated identity credential objects found in the Entra export
1|--aws-json tests/fixtures/aws_list_roles_hit.json|FOUND: input: AWS role fixture-deploy: trust policy allows any AWS account (Principal "*"); check for an unexpected UpdateAssumeRolePolicy [THN]
1|--aws-json tests/fixtures/aws_list_roles_hit.json|FOUND: input: AWS role fixture-list: trust policy allows any AWS account
1|--aws-json tests/fixtures/aws_list_roles_hit.json|REVIEW: input: AWS role fixture-gh-loose: trusts the GitHub OIDC issuer with no sub condition, so any repository can assume it (OUR ADVICE: scope to repo and branch)
1|--aws-json tests/fixtures/aws_policy_star.json|FOUND: input: AWS (no RoleName in the file): trust policy allows any AWS account
0|--aws-json tests/fixtures/aws_clean.json|RESULT: NO INDICATORS FOUND
5|--aws-json tests/fixtures/aws_urlenc.json|REVIEW: input: the AWS export holds URL-encoded policies that were not checked
1|--repo @G@/git_hit --name fx-repo|FOUND: fx-repo: branch origin/wfx-docs (probe branch wfx-docs) [THN]
1|--repo @G@/git_hit --name fx-repo|FOUND: fx-repo: branch wfx-docs (probe branch wfx-docs) [THN]
1|--repo @G@/git_hit --name fx-repo|FOUND: fx-repo: commit subject 'ci: refresh build cache' x1 (
1|--repo @G@/git_hit --name fx-repo|FOUND: fx-repo: commit subject 'docs: dependency audit notes' x1 (
1|--repo @G@/git_hit --name fx-repo|REVIEW: fx-repo: branch chore/a1b2c3d4 (matches chore/[a-z0-9]{8}; legitimate names can match) [THN]
1|--repo @G@/git_hit --name fx-repo|REVIEW: fx-repo: branch origin/ci-check-2830 (matches ci-check-[0-9]{4}; also seen in the October wave) [THN]
1|--repo @G@/git_hit --name fx-repo|REVIEW: fx-repo: commit subject 'ci: restore' x1 (
5|--repo @G@/git_review|REVIEW: input: commit subject 'ci: cleanup' x2 (
5|--repo @G@/git_review|REVIEW: input: branch chore/abcd1234
0|--repo @G@/git_clean|RESULT: NO INDICATORS FOUND
1|--repo @G@/git_reflog|FOUND: input: commit subject 'chore: add dependency audit workflow' x1 (
1|--repo @G@/git_bare.git|FOUND: input: commit subject 'chore: add ci helper' x1 (
0|--repo @G@/notgit|NOTE: input: git could not read the --repo folder (not a repository, or git refused it); branch and commit checks skipped
1|--repo @G@/git_hit --dir tests/fixtures/dir_lock_3144 --aws-json tests/fixtures/aws_policy_star.json|locks digitalelvis/neuronai-studio 3.14.4
1|-Dir tests/fixtures/dir_hit -Name Fx-01|VERDICT: Fx-01: INDICATORS FOUND
1|--dir tests/fixtures/dir_hit|check-wfx-ci-stealer: offline, read-only check for the wfx GitHub Actions secret stealer (November 2026, no CVE).
1|--dir tests/fixtures/dir_hit|SOURCES: [THN] published research, as reported by The Hacker News (12 Nov 2026); [RESEARCH ONLY, not on the THN page]
4||Usage:
4|--dir|Usage:
4|--bogus x|Usage:
4|--dir tests/fixtures --dir tests/fixtures|Usage:
4|--extra-sha256 abc --dir tests/fixtures|ERROR: --extra-sha256 takes 64 hex characters
4|--extra-ip 1.2.3 --dir tests/fixtures|ERROR: --extra-ip takes an IPv4 address
4|--dir tests/fixtures/missing|ERROR: cannot read folder: tests/fixtures/missing
4|--repo tests/fixtures/entra_hit.json|ERROR: cannot read folder: tests/fixtures/entra_hit.json
4|--entra-json tests/fixtures/missing.json|ERROR: cannot read file: tests/fixtures/missing.json
4|--aws-json tests/fixtures/dir_hit|ERROR: cannot read file: tests/fixtures/dir_hit
5|--dir tests/fixtures/dir_go_284|REVIEW: input: file go.mod references github.com/onuragtas/docker-env v1.0.284 (payload is in a workflow file only; Go builds do not run it; remove this version) [OURS]
5|--dir tests/fixtures/dir_go_284|REVIEW: input: file go.mod references github.com/onuragtas/redock v1.0.284 (payload is in a workflow file only; Go builds do not run it; remove this version) [OURS]
