⬢github Go · 23 ★ +22 since we first saw it · pushed 1 h ago · MIT
tharun208/cloneguard
Scan a repo for malware tricks before you run it. Catches credential theft, hidden network calls, obfuscated code and auto-run hooks. Read-only, with no dependencies.
CloneGuard is a small, dependency-free Go CLI tool that statically scans cloned repositories for malware tricks before you run anything. Being read-only, it flags credential theft (SSH keys, cloud creds, browser passwords), suspicious network calls to webhooks or raw IPs, obfuscated code, and auto-run hooks like install scripts or editor tasks — giving a severity-based verdict with plain-English explanations.
Why now: It was just submitted to Hacker News, likely resonating because it was built after a fake-recruiter 'demo app' tried stealing SSH and AWS keys — a scam developers recognize.
Who it is for: Developers who clone unfamiliar repos (take-home assignments, open-source projects) and want a quick safety check before running or installing anything.
Stars over our 110 snapshots: 1 to 23, since 1 d ago.
Where people talked about it
API: https://socialmediatrends-api.osmike.com/v1/repos/tharun208/cloneguard