You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
docs: correct the document outline, and say what crawlers may do (#37)
Semantics
The nav was not inside any landmark, so a reader jumping by landmark had a
main and a footer but no header. It is now wrapped in <header>.
Two pages skipped a heading level. check.html went h1 straight to h3 for the
four checks, which ARE the page's top-level sections, so they are h2 now.
changelog.html did the same, and worse: the release version was a <span>, so
the "Fixed"/"Added"/"Changed" groups floated with no release heading above
them and any tool building an outline saw eight sibling h3s belonging to
nothing. Release versions are h2 now, the groups sit under them, and the CSS
mirrors the old span rule so nothing moves visually.
All nine pages: exactly one h1, no skipped levels, one main, one header, one
footer.
Structured data
Only index.html had any. Every page now carries a BreadcrumbList, and three
carry the type that fits what someone is actually asking:
infected.html HowTo, four steps with anchors — "how do I remove this
malware" is what gets typed mid-incident
install.html SoftwareApplication with the current version
check.html FAQPage covering the three questions people ask: how do I
know, why did npm audit miss it, and does a clean process
check mean I am safe
Crawlers
robots.txt named 29 crawlers explicitly rather than leaving search engines
and AI answering engines to infer permission from a bare wildcard, and says
in a comment why: the point of this site is that people find it before they
are compromised.
llms.txt gives an assistant a compact authoritative summary — the threat,
the response order, and the two things people reliably get wrong — instead
of leaving it to reconstruct one from nine pages of HTML.
sitemap.xml gained lastmod, so a crawler can tell what changed.
Co-authored-by: Avioflagos <ellumainc@gmail.com>
# Page-specific structured data. A HowTo on the response walkthrough is the
89
+
# one that matters: "how do I remove this malware" is what someone types
90
+
# mid-incident, and HowTo is the type that answers it.
91
+
case"$out"in
92
+
infected.html)
93
+
cat <<HOWTO
94
+
<script type="application/ld+json">
95
+
{"@context":"https://schema.org","@type":"HowTo",
96
+
"name":"Remove a committed supply-chain dropper from your repositories",
97
+
"description":"$desc","url":"$SITE$out",
98
+
"totalTime":"PT30M",
99
+
"tool":[{"@type":"HowToTool","name":"snare"}],
100
+
"step":[
101
+
{"@type":"HowToStep","position":1,"name":"Rotate your credentials",
102
+
"text":"Stealing credentials is the objective; removing the payload does not un-steal a token. Revoke npm write tokens first, then GitHub tokens, SSH keys and cloud keys.","url":"$SITE$out#rotate"},
103
+
{"@type":"HowToStep","position":2,"name":"Clean the machine you push from",
104
+
"text":"This family injects into commits as they leave an already-infected machine, so cleaning a repository first is wasted work.","url":"$SITE$out#machine"},
105
+
{"@type":"HowToStep","position":3,"name":"Clean the repositories",
106
+
"text":"snare fix is a dry run by default and always backs up first. Purging history rewrites every commit SHA, so every clone must be re-cloned rather than pulled.","url":"$SITE$out#repos"},
107
+
{"@type":"HowToStep","position":4,"name":"Tell your collaborators",
108
+
"text":"They may be infected from the same source, and a rewritten history breaks their clones without explanation.","url":"$SITE$out#notify"}]}
{"@type":"Question","name":"How do I know if my machine is infected with this malware?",
129
+
"acceptedAnswer":{"@type":"Answer","text":"Look for a node process running inline code with obfuscated globals, any file carrying the operator's wallet address, a .vscode/tasks.json task set to runOn folderOpen, and font files whose first four bytes are not a real font magic. A genuine .woff2 begins with wOF2."}},
"acceptedAnswer":{"@type":"Answer","text":"No. The dropper is committed into the repository itself rather than pulled from the registry, so there is no malicious dependency for npm audit, the lockfile or Dependabot to report."}},
132
+
{"@type":"Question","name":"My process check came back clean. Am I safe?",
133
+
"acceptedAnswer":{"@type":"Answer","text":"Not necessarily. The loader runs when a build runs or an editor opens the folder, then exits. A clean process check alongside infected repositories is the expected result, not a contradiction."}}]}
134
+
</script>
135
+
FAQ
136
+
;;
137
+
esac
138
+
74
139
# keyword + structured data only on the entry page
{"@type":"Question","name":"How do I know if my machine is infected with this malware?",
36
+
"acceptedAnswer":{"@type":"Answer","text":"Look for a node process running inline code with obfuscated globals, any file carrying the operator's wallet address, a .vscode/tasks.json task set to runOn folderOpen, and font files whose first four bytes are not a real font magic. A genuine .woff2 begins with wOF2."}},
"acceptedAnswer":{"@type":"Answer","text":"No. The dropper is committed into the repository itself rather than pulled from the registry, so there is no malicious dependency for npm audit, the lockfile or Dependabot to report."}},
39
+
{"@type":"Question","name":"My process check came back clean. Am I safe?",
40
+
"acceptedAnswer":{"@type":"Answer","text":"Not necessarily. The loader runs when a build runs or an editor opens the folder, then exits. A clean process check alongside infected repositories is the expected result, not a contradiction."}}]}
<divclass="panel" style="margin-top:8px"><divclass="panel-bar"><spanclass="label">and the full history — a deleted file still lives in Git</span><divclass="bar-actions"></div></div>
0 commit comments