npm-security container code

[giriparus]

No description provided.

[Copilot]

Pull request overview

This PR introduces a Docker-based security scanning solution for npm dependencies, specifically designed to detect the Sha1-Hulud malware that emerged on November 24, 2025. The container performs security validation of GitHub tokens, installs npm dependencies, and scans JavaScript files for known malicious hashes and patterns.

Key Changes:

• Implements a containerized npm security scanner with checksum and pattern-based detection
• Adds token validation to prevent write-access tokens from being used
• Provides structured exit codes for different failure scenarios (security alerts vs installation errors)

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
Dockerfile	Sets up Alpine-based Node.js container with security-focused user permissions
entrypoint.sh	Main security scanning logic including token validation, npm installation, and malware detection
checksums/sha1-hulud.txt	Database of malicious SHA256 hashes for Sha1-Hulud malware detection
patterns/sha1-hulud.txt	Pattern signatures for detecting malicious code structures
README.md	Comprehensive documentation of the security container's usage, features, and integration examples

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The Dockerfile copies .npmrc but this file is not included in the PR. If .npmrc doesn't exist in the repository, the Docker build will fail. Either add the .npmrc file or make this copy operation conditional.

Suggested change

	COPY .npmrc /home/node/.npmrc
	RUN if [ -f .npmrc ]; then cp .npmrc /home/node/.npmrc; fi

[Copilot]

The checksum and pattern files in the checksums/ and patterns/ directories are not copied into the Docker image, but entrypoint.sh references them. This will cause the security scanning to fail silently. Add COPY commands for these directories.

Suggested change

	COPY entrypoint.sh /entrypoint.sh
	COPY entrypoint.sh /entrypoint.sh
	COPY checksums/ /home/node/test/checksums/
	COPY patterns/ /home/node/test/patterns/