live · scanning repos
Scanrepo
github.com
github.com / AikidoSec

AikidoSec/safe-chain

JavaScript·254 files·commit ee5e10c·scanned 6h ago·cached ✓
25/100
LOW RISK
Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 25 — 1,836 stars — findings likely legitimate code patterns

verdict accurate?
threat-state: lowlive

FINDINGS ░▒▓

what this code does░▒▓

What happens when you open, install or run it, from the findings below.

  1. when runinstall-scripts/install-endpoint-linux.sh and 2 other files download a script and pipe it to the shell. install-scripts/install-endpoint-linux.sh, install-scripts/install-endpoint-mac.sh, install-scripts/install-noon-mac.sh
criticalRemote script piped into a shellA shell script downloads remote content and executes it directly (e.g. `curl … | bash`). The payload is never stored or reviewable and can change server-side — a classic malware/backdoor install pattern.install-scripts/install-endpoint-linux.sh
#
# Usage: curl -fsSL <url> | sudo sh -s -- --token <TOKEN> [--headless] [--container|--ci-cd]
#    or: curl -fsSL <url> | sudo AIKIDO_TOKEN=<TOKEN> sh -s -- [--headless] [--container|--ci-cd]
#
+10
criticalRemote script piped into a shellA shell script downloads remote content and executes it directly (e.g. `curl … | bash`). The payload is never stored or reviewable and can change server-side — a classic malware/backdoor install pattern.install-scripts/install-endpoint-mac.sh
#
# Usage: curl -fsSL <url> | sudo sh -s -- --token <TOKEN>

set -e  # Exit on error
+10
criticalRemote script piped into a shellA shell script downloads remote content and executes it directly (e.g. `curl … | bash`). The payload is never stored or reviewable and can change server-side — a classic malware/backdoor install pattern.install-scripts/install-noon-mac.sh
#
# Usage: curl -fsSL <url> | sudo sh -s -- --token <TOKEN>

set -e
+10
infoSuspicious file in repoExecutable file (install-endpoint-windows.ps1) in repositoryinstall-scripts/install-endpoint-windows.ps1+2
infoSuspicious file in repoExecutable file (install-noon-windows.ps1) in repositoryinstall-scripts/install-noon-windows.ps1+2
infoSuspicious file in repoExecutable file (install-safe-chain.ps1) in repositoryinstall-scripts/install-safe-chain.ps1+2
infoAuthor has no other public repositoriesGitHub user "github-actions[bot]" has no other public repositories, common for burner accounts used in scams.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

228 files scanned @ ee5e10c | 10/30/2026 | heuristic scan — always review manually

risk by category
code execution25
network & exfiltration0
file system access0
obfuscation0
supply chain15
owasp / injection0
telemetry
files 228/254rules hit 7engine v10commit ee5e10c

github

AikidoSec/safe-chain

Protect against malicious code installed via npm, yarn, pnpm, npx, pnpx, pip, uv and poetry with Aikido Safe Chain. Free to use, no tokens required.

JavaScript
1836
118
476d
254 files
228 scanned(90%)
ee5e10c

network indicators░▒▓

Hosts this code names or would connect to. Top 50 of 68, decoded and call-site destinations first. Informational, not scored.

architecture░▒▓

entry (0) flagged (0) pkg (17)
229 nodes · 474 edgesscroll to zoom · click node to jump to finding