after the alert

Scripts for local checks

Choose the check you need. Download the file, read its source, then run it on a trusted machine. Each needs Node.js or Bash, as listed below, with no additional packages.

Command-line scripts

Check a PHP version

Compare one supplied upstream version against four fixed branch floors. Distro backports need separate evidence.

check-php-version.mjs · Node.js

Download script
How to run

Run on a trusted machine. Supply the version you found in your deployment. The script compares that string; it does not scan a server or run PHP.

From the folder containing the downloaded script:

node check-php-version.mjs 8.3.35

All three scripts are read-only. A completed check does not certify a system as safe. Read output meanings and limitations.

Find LiteLLM in dependency files

Check selected requirements, lockfiles, Dockerfiles and Compose files for LiteLLM declarations. No Python, pip, project imports or network.

inspect-dependency-files.mjs · Node.js

Download script
How to run

Run on a trusted machine with selected, read-only text files. Replace the example filenames with your own. Inputs are capped at 2 MiB per file. A declaration does not establish installation or execution.

From the folder containing the downloaded script:

node inspect-dependency-files.mjs --json -- requirements.txt uv.lock Dockerfile

All three scripts are read-only. A completed check does not certify a system as safe. Read output meanings and limitations.

Inspect offline LiteLLM metadata

Inspect an offline site-packages copy. Reports metadata and marker filenames without reading file contents or executing packages.

inspect-litellm-metadata.sh · Bash

Download script
How to run

Pass the physical path to an offline copy of site-packages. The script checks immediate entry names and rejects symlink paths. Neither Python nor pip is started. Missing markers do not clear historical exposure.

From the folder containing the downloaded script:

bash inspect-litellm-metadata.sh /physical/path/to/site-packages

All three scripts are read-only. A completed check does not certify a system as safe. Read output meanings and limitations.

Need a record to fill in? Get CSV templates and the offline kit.