⬢github Go · 33 ★ +32 since we first saw it · pushed 5 d ago · MIT
tharun208/cloneguard
Scan a repo for malware tricks before you run it. Catches credential theft, hidden network calls, obfuscated code and auto-run hooks. Read-only, with no dependencies.
CloneGuard is a small, dependency-free Go CLI tool that statically scans cloned repositories for malware tricks before you run anything. Being read-only, it flags credential theft (SSH keys, cloud creds, browser passwords), suspicious network calls to webhooks or raw IPs, obfuscated code, and auto-run hooks like install scripts or editor tasks — giving a severity-based verdict with plain-English explanations.
Why now: It was just submitted to Hacker News, likely resonating because it was built after a fake-recruiter 'demo app' tried stealing SSH and AWS keys — a scam developers recognize.
Who it is for: Developers who clone unfamiliar repos (take-home assignments, open-source projects) and want a quick safety check before running or installing anything.
Stars over our 643 snapshots: 1 to 33, since 6 d ago.
Where people talked about it
API: https://socialmediatrends-api.osmike.com/v1/repos/tharun208/cloneguard