The utility inspects files strictly through static reading without ever importing, compiling, or executing the target codebase. It flags patterns like raw IP connections, bundled compiled binaries, obfuscated commands, and malicious editor configurations that auto-run tasks. Findings that combine unauthorized secret access with external network calls are automatically escalated to critical severity ratings. Designed for integration into developer workflows, the system requires Go 1.24 or higher and outputs reports in plain text or JSON.
Key points
Developers can scan both local directories and remote repositories to detect credential t…: Developers can scan both local directories and remote repositories to detect credential theft risks before running unfamiliar code.
Malicious demo repositories often attempt to steal SSH keys, cloud credentials, browser p…: Malicious demo repositories often attempt to steal SSH keys, cloud credentials, browser passwords, and crypto wallets using automated install hooks.
Plain text and JSON reporting formats alongside specific exit codes allow the tool to int…: Plain text and JSON reporting formats alongside specific exit codes allow the tool to integrate directly into Git hooks and automation scripts.
Sources checked by our analysis pipeline: 1
Scan a project for malware tricks before you run it. Built after a fake-recruiter "demo app" tried to steal SSH and AWS keys.
cloneguard is a small, dependency-free Go command-line tool. It only reads files. It never runs, installs, or imports anything from the project it scans.
A common attack goes like this: someone posing as a recruiter sends you a "take-home
assignment" or "demo app". You clone it, run npm install
or open it in your editor,
and it quietly uploads your SSH keys, cloud credentials, browser passwords or crypto
wallets. Often the trigger isn't the app itself but an install hook or an editor task
that runs the moment you open the folder.
cloneguard is a quick first look that catches the usual tricks, so you can decide whether the project is safe to touch.
Requires Go 1.24+. There are no third-party dependencies.
go build -o cloneguard ./cmd/cloneguard
Optionally put the binary on your PATH, for example mv cloneguard /usr/local/bin/
.
cloneguard clone https://github.com/someone/demo-app # clone, then scan right away
cloneguard scan ./some-folder # scan an existing folder
The transaction expands the search giant's physical footprint directly into Wyoming through a newly secured facility. This acquisition provides dedicated infrastructure capacity to support the company's broader operational demands. Securing the location represents a direct investment into the state's growing role in tech infrastructure.
Following the closure of the digital distribution platform, advocates are seeking legal avenues to preserve affected media. The proposed regulatory relief under federal copyright law aims to ensure consumers maintain access to content when streaming services terminate operations. This effort has drawn considerable focus from communities dedicated to technology and digital preservation.
Content creators can secure an updated hybrid audio setup at a substantial discount across several major storefronts. Designed for streamers and podcasters, this model provides flexible connectivity alongside automated sound processing to minimize manual mixing. The promotion makes professional-style recording equipment significantly more accessible for home studio workflows.