Skip to main content
← back to extensions

Emudhra

@taylor/emudhrav2026.10.22.6· AGPL-3.0-or-later· 4d agoBEHAVIORSACCEPTED WARNINGS
01README

Find where the leaked private keys of eight compromised eMudhra certificate authorities can still be used against you. Anyone can recover these keys (disclosed 2026-10-20, https://emudhra.we-have-a-problem.com/) and use them to impersonate any website or sign code that clients still trust. Browsers and OS stores block them, but curl, Python, Java, Go, Node.js, Deno, Electron apps and container images often still trust them. Checks Linux, macOS and Windows hosts, Linux and macOS machines over SSH, container images and running containers: PEM CA bundles and Java keystores matched by public key (honouring blocked.certs and OpenSSL trust settings), any EC CA whose private key is small enough to recover the same way, the macOS and Windows verifiers, and the versions of tools that carry their own roots (Node.js, Go, Deno, Bun, uv, pixi, rustup, mise, Claude Code, Docker Desktop, cloudflared, Cloudflare WARP, Electron apps) and the packages pinned in Cargo, Mix, rebar3, uv, Poetry, PDM, Pipenv and Composer lockfiles against the patched releases. Records exposed, protected or unknown per target for TLS and code signing, with what to do about it; changes nothing.

02Behaviors1
@taylor/emudhra/exposurev2026.10.22.6emudhra_exposure.ts

Global Arguments

ArgumentTypeDescription
host?booleanScan the machine swamp runs on
images?arrayContainer images to scan, e.g. ["debian:bookworm", "python:3.12-slim"]
containers?arrayRunning containers to scan, by name or ID
sshHosts?arrayLinux and macOS machines to scan over SSH, as ssh destinations, e.g. ["web1", "admin@db1", "ssh://admin@db2:2222"]
sshKey?stringPrivate key to log in with over SSH; otherwise ssh's own configuration and agent decide
sshOptions?arrayMore ssh arguments, ahead of the scan\
searchPaths?arrayDirectories to search for lockfiles (Cargo, Mix, rebar3, uv, Poetry, PDM, Pipenv, Composer), on the host and over SSH
runtime?enumContainer runtime: docker (or podman via runtimePath), or container (Apple's container CLI)
runtimePath?stringPath to the runtime CLI if it is not `docker`/`container` on PATH
bundles?arrayMore PEM CA bundles to check, on the host and in every container
keystores?arrayMore Java keystores (JKS or PKCS#12) to check, on the host and in every container
toolchains?booleanOn the host and over SSH, also check Python certifi, pip, Perl Mozilla::CA, Java runtimes, Node.js, Go, Deno, Bun, uv, pixi, rustup, mise, Claude Code, Docker Desktop, cloudflared, Cloudflare WARP and Electron apps
fn scan(failOnExposed?: boolean)
Check the host and the named images and containers for trust in the compromised eMudhra intermediates; changes nothing
ArgumentTypeDescription
failOnExposed?booleanFail the run, after recording the results, when any target is exposed

Resources

target(infinite)— Whether one machine, image or container trusts the compromised eMudhra intermediates, and why
summary(infinite)— Which targets the last scan found exposed, protected or unknown
03Previous Versions8
2026.10.22.5AGPL-3.0-or-later(was AGPL-3.0-only)
2026.10.22.4AGPL-3.0-only
2026.10.22.3AGPL-3.0-only
2026.10.22.2AGPL-3.0-only
2026.10.22.1AGPL-3.0-only
2026.10.21.3AGPL-3.0-only
2026.10.21.2AGPL-3.0-only

updated labels

2026.10.21.1AGPL-3.0-only
04Stats
A
100 / 100
Downloads
10
Archive size
107.6 KB
  • Has README or module doc2/2earned
  • README has a code example1/1earned
  • README is substantive1/1earned
  • Most symbols documented1/1earned
  • No slow types (deprecated)1/1earned
  • Dependencies pass trust audit2/2earned
  • Has description1/1earned
  • Platform support declared (or universal)2/2earned
  • License2/2earned
  • Verified public repository2/2earned
Repository
https://github.com/taylorific/swampworks

06Platforms
07Labels
#security#certificates#pki#vulnerability#containers#java#ssh#lockfiles