About ░▒▓

ScanRepo is a free scanner for GitHub and Bitbucket repositories. It reads every file it can and reports what malware would look like — honestly, including what it cannot know.

How a Scan Works ░▒▓

01Snapshot

The whole repository is downloaded as a tarball at the scanned commit — one request, every file. No sampling blind spots.

02Static rules

60+ detection rules across JS/TS, Python, Rust, Go and shell check for code execution, exfiltration, credential theft, obfuscation and supply-chain patterns.

03Statistical passes

Shannon entropy, string-literal analysis and control-flow heuristics catch obfuscated payloads that defeat keyword matching.

04Architecture graph

An import graph marks findings reachable from entry points higher than dead code, separating real attack paths from noise.

05Signals & context

Repo age, traction, trusted publishers and project type (CLI, Electron, library) discount expected-capability false positives.

06LLM verdict

High-risk scans get a second opinion from a language model that distinguishes dangerous capability from malicious intent.

Honest Limitations ░▒▓

01A static scanner sees code, not behavior. Clever malware can look boring — treat LOW RISK as 'nothing found', never as a guarantee.

02Very large repositories are capped at 3,000 content-scanned files; the report always shows real coverage.

03Minified or vendored bundles are mostly skipped — that is also where legitimate build output lives.

04Scores are heuristics. Popular and verified-organization repos get capped scores because their patterns are usually legitimate, which a determined attacker could theoretically abuse.

05The LLM verdict is an opinion from a small model, labeled with its confidence. It informs the score; it does not decide it.

What We Look For

Code Execution

eval, child_process, shell pipes

Network & Exfiltration

C2 domains, hardcoded IPs

Credential Theft

browser profiles, wallets, SSH

Obfuscation

string arrays, hex blobs, entropy

Supply Chain

install scripts, malicious deps

Injection

SQL, XSS, path traversal

Feedback & Corpus ░▒▓

Wrong verdict? Every scan page has feedback buttons — false positives reported there become regression tests for the rule engine.

scan a repo malware corpus