[prodbycorne]

Summary

Adds `.github/workflows/security-extended-scan.yml` — a second GitHub Actions CI check that runs on every push and pull request, covering a broad set of threats beyond PolinRider.

What is checked

#	Check	What it catches
1	Hardcoded private keys	RSA, EC, OpenSSH, PGP, PKCS8 private keys committed to source
2	Hardcoded tokens	GitHub PATs, npm tokens, AWS credentials, OpenAI keys, Stellar secret keys
3	Committed .env files	Real .env files (not .env.example) with non-comment content
4	Obfuscated eval payloads	eval(atob(...)), Function(...)(), String.fromCharCode chains, hex escape sequences
5	Raw-IP network calls	fetch/axios/WebSocket to hardcoded IP addresses (C2 / exfiltration indicator)
6	Crypto miner patterns	stratum+tcp://, coinhive, xmrig, cryptonight, mining pool hostnames
7	Reverse shell / backdoor	child_process.exec with shell args, net.connect to IPs, nc -e patterns
8	Lifecycle script downloads	postinstall/prepare scripts running curl/wget
9	Suspicious postinstall scripts	postinstall/prepare running node on unexpected file paths
10	Dropper shell scripts	.sh files that pipe curl/wget output into a shell
11	Base64 blobs	Large base64-encoded strings in source files (encoded payload indicator)
12	Typosquatted packages	Known lookalike package names in package.json dependencies
13	Committed binaries	.exe, .dll, .so, .dylib files in the source tree
14	Env-var exfiltration	process.env values passed directly into network calls

Any hit fails the job with a file-annotated ::error pointing to the exact line.

Test plan

• Merge → CI runs clean on main
• Add ghp_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA to a test file → CI flags it