Supply-chain malware scanner for Git repos. Finds droppers committed into the repo itself — the kind npm audit can't see because there's no malicious dependency. Runs on git clone or when VS Code opens the folder. Kills the loader, scans every repo you can reach, purges it from history.
nodejs macos linux npm security incident-response malware vscode infosec devsecops malware-detection malware-scanner threat-detection supply-chain-security github-security clipboard-stealer npm-security shai-hulud supply-chain-attack etherhiding
-
Updated
Sep 10, 2026 - Shell