Check a repo before you clone it
The safest way to look at a repo you do not know yet.
On this page
A common way this malware reaches developers is a coding test or “take-home project” sent by a recruiter, or a repo you found online. It arrives as a normal-looking repo. You clone it, open it in VS Code or run npm install, and it runs.
#Check the link first
forkguard recruiter/take-home-testThat downloads only the latest commit of every branch into a temporary folder, reads it from git’s database without unpacking the files, and deletes the download. Details.
- Result says looks clean: you can clone and open it.
- Result shows anything HIGH: do not clone it, do not open it and do not run it.
#Clone only if it was clean
forkguard recruiter/take-home-test && git clone https://github.com/recruiter/take-home-testThen check the folder once more after cloning:
cd take-home-test
forkguard#Open it carefully
- When VS Code asks whether you trust the authors of the folder, choose No unless you have checked it. Untrusted folders open in Restricted Mode, where tasks do not run. Reports on this campaign describe that prompt as the main gate.
- Turn off automatic tasks for good with `forkguard setup`. It sets
task.allowAutomaticTasksto"off". - To only read the code, you can open a repo in the browser with github.dev, which does not run local tasks.
- Do not run install or start scripts until you have read
package.json.
#Things to look at yourself
| Where | What looks wrong |
|---|---|
package.json scripts | A script that runs node init, or a file from a fonts or assets folder, before the real command |
.vscode/tasks.json | Any task with "runOn": "folderOpen" |
public/fonts, static, assets | A font file you cannot open as a font |
Config files (postcss.config.mjs, tailwind.config.js, next.config.mjs, vite.config.js) | Scroll all the way to the right on the longest line |
| Dependencies | An unfamiliar “tailwind-something” or “style-animate” package |