forkguard

forkguard checks a folder for malware hidden in it. It only reads files. It never changes anything.

forkguard
forkguard path/to/project
forkguard path/to/project --json

folder

The folder to check. Optional. Defaults to the folder you are in.

--json

Print the results as JSON instead of text.

Checks every file in the folder that this malware is known to use, and reports each problem with a level, a file and a plain-words message. It takes well under a second for a typical project.

#What it reads

• JavaScript and TypeScript files (.js .mjs .cjs .ts .mts .cts .jsx .tsx .vue .svelte) and any file named init.
• package.json and lockfiles (package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, bun.lock).
• .vscode/tasks.json, .vscode/settings.json and .vscode/extension.json.
• Font files (.woff .woff2 .ttf .otf .ttc .eot) and README.md files inside fonts folders.
• Dropped files such as config.bat and temp_auto_push.bat, and any .bat, .cmd or .sh script.
• .gitignore, and .env files.

#What it skips

node_modules, .git, .next, .nuxt, .svelte-kit, .turbo, .vercel, .output, dist, build, out, coverage, .cache, .parcel-cache, vendor, __pycache__, .venv and venv. These hold generated code rather than yours, and skipping them is what keeps the check fast. Files larger than 6 MB are skipped too.

#When the folder is a git repo

• Reports .env files that are already committed, and .env files git is not ignoring.
• When a HIGH problem is found, also checks whether your latest commit was rewritten after it was made (same moment, different timezone).

#Always

Checks whether npm itself on your computer is infected, because an infected npm would bring the malware back after every cleanup. It reads npm’s files directly and never runs npm to do it.

A clean project prints one line:

forkguard  my-app looks clean (433 files checked)

A project with problems prints one line per problem:

forkguard  my-app

  HIGH  init          Code hidden after 776 blank spaces on line 35
  HIGH  package.json  "dev" runs a hidden file called init before your real command
  MED   .gitignore    Hides config.bat, a file this malware drops

  3 problems found. Do not run npm install, npm run dev or open this folder in VS Code yet.
  Run forkguard fix to clean it, or forkguard pr to clean it and open a pull request.

Each line shows the level, the file and what is wrong. Problems are sorted with the most serious first.

When a problem can be fixed automatically, the last line points you to forkguard fix and forkguard pr.

--json

Print { root, checked, findings } as JSON. See JSON output.

--help, -h

Print all commands.

--version, -v

Print the version.

The same codes work in scripts and CI. See Exit codes.

NO_COLOR=1

Turn off colors in the output.

Check the folder you are in:

forkguard

Check a folder you are not in:

forkguard ~/projects/take-home-test

Use it in a script, and stop if something dangerous is found:

forkguard --json > report.json || echo "stop: forkguard found something"