jestasecurity

jestasecurity/thumper

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

222 stars 13 forks 222 watchers Python Apache License 2.0

canary canarytokens credential-theft devsecops endpoint-security honeytoken honeytokens incident-response malware-detection npm npm-security open-source security shai-hulud supply-chain-attack supply-chain-security threat-detection tripwire

View on GitHub Website

28 Open Issues Need Help Last updated: Jul 2, 2026

Open Issues Need Help

View All on GitHub

Dashboard: disable Resolve / Resolve-all while the request is in flight about 3 hours ago

enhancement good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

CopyField: clipboard fails over plain http (LAN) — add a fallback about 3 hours ago

enhancement good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

UI copy still says "sudo required" / "fs_usage" — inaccurate after the FIFO sensor about 3 hours ago

bug good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Expose the server version in /healthz and the Settings page 4 days ago

enhancement good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Modal: close on Escape (and basic focus handling) 4 days ago

enhancement good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Add a CHANGELOG.md 4 days ago

documentation good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Show a platform badge/icon in the Endpoints table 4 days ago

enhancement good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Add a Docker (~/.docker/config.json) honeytoken type 4 days ago

enhancement good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Validate numeric agent CLI args (--poll/--heartbeat/--sync-interval) 4 days ago

enhancement good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Set a per-page browser tab title (document.title) 6 days ago

enhancement good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Show the absolute timestamp on hover for relative times (timeAgo) 7 days ago

enhancement good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Remember the Dashboard auto-refresh interval across reloads (localStorage) 7 days ago

enhancement good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Strip whitespace from tripwire name on create (match rename behavior) 8 days ago

bug good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Add --help/-h and --version flags to the agent CLI 8 days ago

enhancement good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Confirm before "Resolve all" alerts on the Dashboard 8 days ago

enhancement good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

a11y: add aria-labels to icon-only buttons 8 days ago

enhancement good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Add a GitLab PAT honeytoken type 8 days ago

enhancement good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Add unit tests for the honeytoken generators (tests/test_generator.py) 8 days ago

good first issue tests

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Docs: add a "How to add a honeytoken type" guide (docs/tokens.md) 8 days ago

documentation good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Add .editorconfig for consistent formatting 8 days ago

enhancement good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Document THUMPER_ALLOWED_HOOK_CIDRS and THUMPER_SECRET_KEY env vars 8 days ago

documentation good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Assigning a tripwire to an endpoint gives no UI signal that planting is deferred until the next agent sync 8 days ago

enhancement good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Add GitHub issue and PR templates 8 days ago

enhancement good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Add an npm (.npmrc) honeytoken type 8 days ago

enhancement good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Startup Logs 10 days ago

enhancement good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Fake installation output 10 days ago

bug good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Missing log of Heartbeat succeeded 11 days ago

bug good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire

Change "instances" to "tripwires" in Endpoints page 16 days ago

enhancement good first issue

jestasecurity/thumper

222

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

Python

#canary#canarytokens#credential-theft#devsecops#endpoint-security#honeytoken#honeytokens#incident-response#malware-detection#npm#npm-security#open-source#security#shai-hulud#supply-chain-attack#supply-chain-security#threat-detection#tripwire