Documentation
Catch malware hidden in a repo before you install or run it. Check a folder, a GitHub link or every repo you own, then clean what it finds and open a pull request.
npx forkguardNo install needed: npx runs it once. You need Node.js 18 or newer and git. If it prints a list, something is wrong. If it prints one green line, you are fine.
#Start here
New to forkguard? Follow these four steps in order. Each one is a few minutes.
- Install itOne command. Needs Node.js 18+ and git.
- Check a projectYour first check, and how to read the result.
- Clean itRemove what it found and get your original files back.
- Stay protectedCheck automatically before every npm install, for good.
#I want to…
Already know what you need? Jump straight to it.
- Check a repo before I clone itCoding tests, recruiter repos, anything unknown.
- Check all my repos on GitHubOne command, every branch.
- Clean an infected projectWhat to do, in order.
- Fix it on GitHubOpen a pull request with the fix.
- Check every pushAdd the GitHub Action.
- Protect my AI agentRules for Claude Code, Cursor, Copilot, Codex.
- Understand a messageWhat each line of the output means.
- See every ruleEverything forkguard looks for.
- Use it in a scriptJSON output and exit codes.
- Fix a problemTroubleshooting and FAQ.
#Every command
| Command | What it does | Changes anything? |
|---|---|---|
| `forkguard` | Checks the current folder, or another one | No |
| `forkguard owner/repo` | Checks a GitHub repo, every branch, without downloading its files | No |
| `forkguard --mine` | Checks every repo you own on GitHub | No |
| `forkguard fix` | Removes what it found, on your computer | Yes, your files |
| `forkguard pr` | Removes it on a new branch and opens a pull request | Yes, a branch and a pull request |
| `forkguard setup` | Checks automatically before npm install and after git clone | Yes, your shell profile |
| `forkguard agent` | Safety rules for AI coding agents (next release) | Only with --write |
Only fix, pr, setup and agent --write ever change anything. Checking is always read only.
#What forkguard does
Some malware hides inside ordinary looking repositories. The code sits after hundreds of blank spaces at the end of a normal line, so your editor shows nothing. It rewrites your latest commit, keeping the author, date and message, so git shows nothing either. The moment you open the folder in VS Code, or run npm install or npm run dev, it runs, steals tokens and keys, and spreads to every repo you can push to.
forkguard looks for every trick this malware uses, before anything runs. It never runs code from the project it checks, and it never uploads your code anywhere.
- Zero dependencies. A tool you run before
npm installshould not neednpm install. - Cross platform. Windows, macOS and Linux, with PowerShell, Git Bash, bash and zsh.
- Private. No account and no telemetry. The only network calls are downloading a repo you asked it to check, and talking to GitHub for
forkguard prand--mine. - Free and open source. MIT licensed. Source on GitHub.
#How these pages work
Each command page is laid out like a manual page, with the sections Name, Synopsis, Description and so on. Every section is written twice:
| Switch | You see |
|---|---|
| Off (the default) | Plain words, with examples and sample output. Start here. |
| On, “Less comfortable” | The short reference text you would find in a real manual page. |
Flip the switch on a section to change just that section, or use the switch in the header to change the whole page. Your choice is remembered.