DevGuard

Scan a repository for malware before you open it in your IDE, install its dependencies, or run it.

Malicious repositories (fake job-interview tasks, poisoned forks, hijacked packages) rarely wait for you to run main.py. They run automatically: a VS Code task on folder open, an npm postinstall script, a git hook, an AI assistant hook, a loader hidden in tailwind.config.js. DevGuard finds those triggers, follows them to the code they run, and tells you whether it is safe to proceed. It reads files as data and never executes anything.

Install

pipx install devguard-scanner        # or: uv tool install devguard-scanner

Use

devguard scan path/to/repo

DevGuard scan complete
Target:   interview-task
Verdict:  BLOCK | Do not open, install, or run this project. Strong indicators of malicious behavior were found.
Findings: 5 (1 critical, 2 high, 1 medium, 1 low)
  - [critical] Automatic trigger reaches dangerous code (package.json:5)
  - [high] Browser profile data targeted (lib/collect.js:7)
  - [high] Cryptocurrency wallet data targeted (lib/collect.js:10)
Report (md): ~/.local/share/devguard/reports/interview-task-1a2b3c4d/latest/report.md

Exit code 1 means findings at or above --fail-on (default high), so it works as a CI gate.

More

• Getting started: options, reports, exit codes
• AI investigation: optional explanations from Claude, OpenAI, Gemini, or a local model
• Provider plugins: connect any LLM with a small Python file
• MCP server: let Claude Code, Cursor, or Copilot check a repo before acting on it
• CI and pre-commit · Configuration · How it works
• Contributing · Security policy

Licensed under Apache-2.0.