ZeroDay Scanner

ZeroDay is a read-only Windows scanner that hunts the new wave of supply-chain and AI-assistant attacks traditional antivirus misses: self-propagating npm/PyPI worms (Shai-Hulud, Miasma/TeamPCP class), malicious Python startup hooks (.pth / sitecustomize), hijacked AI coding-assistant configs (Claude, Cursor, VS Code — hooks, tasks.json, MCP servers), tampered agent skills/plugins, prompt-injection via invisible Unicode, credential-exfil GitHub repos, and stealth persistence (Run keys, Startup, scheduled tasks, services).

It runs 11 checks against a baseline you capture once, writes a clear markdown report plus a live self-refreshing status dashboard, and never modifies your system while scanning. When you confirm a threat, a separate, wiper-safe cleanup tool (quarantine.ps1) preserves a forensic copy first, then optionally neutralizes it (reversible) or removes it — and a plain-English REMOVAL.md walks you through the correct isolate-first order that avoids triggering a worm's file-wiper retaliation.

ZeroDay improves itself over time. Supply-chain campaigns churn constantly, so its detection signatures live in an updatable feed (signatures.json), not buried in code. A built-in research-and-merge workflow finds threats disclosed since your last update, verifies each indicator against authoritative advisories (GitHub Advisory Database, OSV / OpenSSF malicious-packages, npm/PyPI, Socket, Microsoft, StepSecurity), and merges only high-confidence, low-false-positive indicators — new worm packages, dropper filenames, exfil hosts, and repo-name patterns — via update-signatures.ps1, which validates and de-duplicates every entry so a bad signature can never flag everything. The scanner unions these with built-in fallbacks and reminds you when signatures go stale, so coverage keeps growing without ever touching the tool's logic.

No install, no dependencies beyond PowerShell, no admin required, and no data leaves your machine. Every release is sealed with a SHA-256 integrity manifest (verify-integrity.ps1) so you can confirm the download is untampered before you trust it.