▓▒░ free malware scanner for public repos
SCAN BEFORE
YOU CLONE_
Fake recruiter "assignments" and trending repos ship credential stealers. Paste a GitHub or Bitbucket URL — 31+ static rules, a 0–100 risk score and a verdict in seconds.
31+ rules6 risk categoriescurated IoC listresults cached
scans today
dangerous today
scans this week
week dangerous
LATEST SCANS
WHAT IT LOOKS FOR
Six risk categories. Findings roll up to the score; known-malicious repos are flagged from a curated IoC list.
01
Code execution
eval(), Function(), child_process
02
Data exfiltration
suspicious domains, hardcoded IPs
03
Credential theft
browser profiles, wallets, SSH keys
04
Obfuscation
hex encoding, minified source
05
Supply chain
postinstall scripts, malicious deps
06
Web vulnerabilities
SQL, XSS, path traversal
QUESTIONS
The short honest answers.
Does ScanRepo clone or execute the repository?
No. It downloads a tarball snapshot of one commit and runs static analysis only — nothing is cloned, installed, or executed on your machine or ours.
What does a “safe” verdict mean?
No known malicious patterns were found. Scores are heuristics, not guarantees — clever malware can look boring, so treat safe as “nothing found”, never as proof.
What does ScanRepo detect?
Credential theft, data exfiltration, obfuscated payloads, supply-chain attacks (postinstall scripts, malicious deps), injection patterns — plus repos and accounts from a curated list of known scams.
Which platforms are supported?
Public GitHub and Bitbucket repositories. Paste a URL and get a 0–100 risk score with a verdict in seconds — no signup, results are cached and shared publicly.
Is ScanRepo free?
Yes. The web scanner and the CLI are free, and the detection corpus is open source.
Can I run it in CI?
Yes — npx scanrepo github.com/owner/repo exits 0 for safe, 1 for suspicious, 2 for dangerous, and --json gives machine-readable output for pipelines.
SAME ENGINE, IN CI
exit 0 safe · 1 suspicious · 2 dangerous — or --json for machines · CLI docs →