Sign in Check a repo

Guides

A repo can run code on your machine before you read a line of it: when the folder opens, when an AI agent starts, when you install, run or commit. These guides show where that code hides, what to change in your tools, and what to do if it already ran.

Checking a repo

How to read a repository before any of it runs.

How to check a GitHub repo for malware before you clone itFake take-home repos run code on folder open or npm install. Which files to read first, which settings to change, and what to do if you already ran it.20 October 2026

Fake jobs and client repos

The take-home and freelance lures, and how they work.

Fake job interview malware: how the take-home repo infects you, and what to check firstHow the fake recruiter take-home works, which repo files start the malware (tasks.json, configs, postinstall, git hooks) and what to do in the first minute.20 October 2026

Editors: VS Code and Cursor

Tasks, workspace trust, dev containers and extensions.

VS Code tasks.json and runOn folderOpen: what runs when you open a folderHow runOn folderOpen works in VS Code tasks.json, what changed in VS Code 1.109, how fake job repos abuse it, and the settings to set before the next repo.20 October 2026

AI coding agents

Claude Code, Cursor, Codex and MCP: what a repo's config can make them run.

Packages and install scripts

npm, pip and friends: what runs when you install.

What npm install runs: postinstall, prepare and the scripts nobody readsThe scripts npm install runs, in order, for a repo and its dependencies. How npm 12, pnpm, Yarn and Bun now gate them, and what --ignore-scripts doesn't stop.20 October 2026

Git

Hooks, config and submodules.

Git hooks security: what a clone can't carry and a zip cangit clone never copies a repo's hooks or config. A zip can ship both, live. Which hooks and config keys run on everyday commands, and how to check first.20 October 2026

If it already ran

What to do after you opened or installed something bad.

What to do after running malware from a stranger's repoRan a fake take-home or a stranger's repo? The order to contain it, revoke GitHub, npm and cloud keys, find persistence, reinstall, and report it.20 October 2026

Tools compared

What other tools cover, from their own docs.

Tools that check a GitHub repo before you clone it, comparedHosted and local GitHub repo scanners compared from their own docs: what each one reads, whether it runs code or sends it anywhere, and which fits when.20 October 2026