doodledood/claude-code-plugins

Python·116 files·commit 3c29306·scanned 4d ago·cached ✓

85/100

MALICIOUS

Matches known-malicious patterns. Do not clone or install.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?

19% file coverage

threat-state: maliciouslive

FINDINGS ░▒▓

criticalRemote script piped into a shellA shell script downloads remote content and executes it directly (e.g. `curl … | bash`). The payload is never stored or reviewable and can change server-side — a classic malware/backdoor install pattern.scripts/check.sh


  macOS/Linux: curl -LsSf https://astral.sh/uv/install.sh | sh
  Homebrew:    brew install uv

+10

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

22 files scanned @ 3c29306 | 10/25/2026 | heuristic scan — always review manually

risk by category

code execution10

network & exfiltration0

file system access0

obfuscation0

supply chain0

owasp / injection0

telemetry

files 22/116rules hit 1engine v7commit 3c29306

github

doodledood/claude-code-plugins

A curated marketplace of Claude Code plugins for agentic development workflows, featuring tools for architecture, knowledge management, and development automation

Python

343d

116 files

22 scanned(19%)

3c29306

architecture░▒▓

entry (0) flagged (0) pkg (28)

39 nodes · 46 edgesscroll to zoom · click node to jump to finding