Introducing Spice: A Free Tool for Checking Your Mac for Post-Exploitation Artifacts

Tom Bowyer

— 3 min read
Share

A developer installs a package.

Maybe it came from npm. Maybe it came from a README. Maybe it came from a tool an AI coding agent pulled into the workflow because it needed to get a test passing.

Everything looks normal.

The install finishes. The project builds. The terminal goes quiet.

But somewhere in the middle of that routine developer motion, something else may have happened.

A lifecycle script ran.A payload dropped.A token was read.A persistence file was written.A package cache now contains something you did not mean to trust.

That is the uncomfortable part of modern software supply chain attacks. They do not always look like an exploit. Sometimes they look like development.

So we built Spice.

Spice is a free, open-source tool that helps developers scan their local machines and projects for known post-exploitation artifacts tied to supply chain incidents like Shai-Hulud and Mini Shai-Hulud. It checks for known package versions, hashes, payload filenames, persistence locations, network indicators, and other incident-specific evidence from public detection packs. (GitHub)

This is not meant to be a full antivirus. It is not magic. A clean scan does not prove a system is safe.

It is something simpler and, we think, useful:

A fast way for developers to ask, “Is there known evidence of this thing on my machine?”

What Spice checks

Spice focuses on the known Shai-Hulud and Mini Shai-Hulud supply chain evidence.

It looks across local files and projects for things like:

  • affected package names and versions
  • known malicious file hashes
  • incident-specific payload filenames
  • persistence files
  • repository marker strings
  • package archives and cache folders
  • manifest and lockfile evidence
  • network and payload indicators
  • startup locations like macOS LaunchAgents
  • suspicious package install or prepare hook context

Spice also builds a local package inventory, so you can search for what it saw by package name, version, ecosystem, path, source file, and digest. (GitHub)

The important part is that Spice is evidence-based.

A finding means “this matched known detection evidence.” It does not automatically mean your machine is compromised. It means you have something worth reviewing. The tool is designed for triage, not panic. (GitHub)

That distinction matters.

Security tools lose developer trust when every result sounds like the end of the world. Spice tries to be clear about what it found, where it found it, and what to do next.

Desktop app and CLI

We wanted Spice to work the way developers actually work.

Some people want a desktop app. Some people want a terminal. Some people want JSON that they can wire into automation.

Spice supports all three.

Install the signed macOS desktop app and CLI:

brew tap turenlabs/tap
brew install --cask turenlabs/tap/spice
spice version

Install only the CLI:

brew tap turenlabs/tap
brew install turenlabs/tap/spice
spice version

Run a targeted Shai-Hulud incident sweep:

spice scan --profile shai-hulud

Scan startup and persistence locations:

spice scan --profile startup

Scan the current project:

spice scan .

Write JSON for automation:

spice scan --json --profile shai-hulud > spice-findings.json

Spice also includes profiles for project scans, incident sweeps, startup/persistence checks, and broader deep scans when you want to trade speed for coverage. (GitHub)

Hardening matters too

Detection is useful, but we also wanted Spice to help developers reduce exposure before the next wave hits.

The desktop app includes a Harden page for reversible npm guardrails. It can show the exact commands it will run and help apply settings like:

npm config set min-release-age 7 --location=user
npm config set save-exact true --location=user
npm config set allow-git none --location=user
npm config set ignore-scripts false --location=user

There is also a stricter option if you want lifecycle scripts disabled globally. And because these are npm settings, you can back them out. (GitHub)

Open source, free, and ready to try

Spice is open source under Apache 2.0. The scanner lives at:

https://github.com/turenlabs/spice

Detection data lives separately, so package rows, IOCs, hashes, filenames, and remediation text can evolve without requiring every engine change to ship through the app. (GitHub)

If you are a developer on macOS, especially one working with AI coding agents, package-heavy projects, or open-source dependencies, give it a scan.

Read more