Black October Check

Black October Check is a GitHub-hosted runbook by dominikmartn for people who run AI coding agents such as Claude Code or Codex on a Mac with full shell access. The user pastes the file into the agent and asks it to run the checks, report, then ask before every fix. The README is dated 2026-10-30 and notes that versions change daily.

What It Is

It is a single instruction document with shell commands, not an installable application. It gives the agent a contract: Phase 1 is read-only and produces one table of item, status (ok, at risk, unknown) and evidence. Phase 2 proposes one fix at a time, shows the exact command and waits for approval. The contract also forbids piping remote scripts into a shell, printing secrets, or running sudo without asking.

What the checks cover

The checks target versions and exposures tied to the October 2026 incidents:

• Node.js and Homebrew brotli versions, plus a string-marker test for patched Brotli decoders in any binary
• Bun and Claude Code builds that embed Bun
• the eMudhra compromised intermediate certificates, tested across curl, nscurl, Python, Node, pip, uv and Java
• Tailscale, Chrome and macOS update levels
• PHP, GitLab, Ruby, Next.js, Storybook and Pillow
• API keys stored on platforms reported as breached
• local hygiene: listeners on all interfaces, firewall state, npm tokens and world-readable env files

Fixes and undo steps

Fixes include upgrading Node, brotli, Claude Code, pip, uv and Tailscale, trimming the affected roots from /etc/ssl/cert.pem, denying the 16 affected certificates in Apple's trust settings, and blocking them in each JDK's blocked.certs. Some steps need a person at the screen to confirm a dialog. The document lists how to undo each change, and a Windows version is described as in progress.

Access and limits

The checklist is publicly readable on GitHub without a payment gate. No license is specified, so public access must not be described as an open-source license. It is a Mac-focused instruction document; a Windows version is in progress. Its security claims and changing version recommendations require checking their linked advisories before operational use.