HN: CloneGuard – scan a repo for credential-stealing tricks before you run it

CloneGuard is a small, dependency-free Go command-line tool for checking unfamiliar repositories for common malware tactics before installing or opening them. Its central safety feature is that it only reads project files: even its clone command downloads a repository without running its code. The tool is intended as an initial screening step against attacks such as fake job assignments designed to steal SSH keys, cloud credentials, browser passwords, or cryptocurrency wallets. It scans existing folders or clones and scans a repository, and can return human-readable or JSON results suitable for scripts and Git hooks.

Its pattern-based checks look for access to sensitive files and environment variables, suspicious network destinations, hidden URLs, downloaded code that is executed, obfuscation, and automatic execution through npm hooks, VS Code tasks, or setup.py. It also flags checked-in compiled binaries and raises severity when risky behaviors occur together - for example, reading secrets while contacting a suspicious server. Findings identify the file, line, relevant snippet, and reason for concern; verdicts and exit codes range from clean to dangerous. Scanning skips common dependency and virtual-environment directories by default, as well as oversized files. CloneGuard is designed to catch recognizable warning signs, not prove a project safe: attackers can evade its rules, and legitimate software may trigger false positives. The guidance is to use a disposable virtual machine or container when handling code from strangers.