Reading the results
What each line means, and what to do about it.
#The three parts of a line
HIGH package.json "dev" runs a hidden file called init before your real command- The level. HIGH can run by itself and steal from you. MED is worth a look but does not run by itself.
- The file. Where it is, relative to the folder you checked. For a GitHub check the lines are grouped by branch.
- The message. What is wrong, in plain words.
| Level | What to do |
|---|---|
| HIGH | Do not install, run or open the project. Clean it first with `forkguard fix` or `forkguard pr`. |
| MED | Read it and decide. Most can be fixed with forkguard fix. |
#Common messages
| Message | It means | What to do |
|---|---|---|
| Code hidden after N blank spaces on line L | The payload sits far to the right of a normal line, where editors do not show it. | forkguard fix cuts it out and restores your original from git history. |
| Contains a known malware signature | The file has a string that only appears in this malware. | Read the file. forkguard fix removes it when the hidden part can be cut. |
| Downloads code from a hidden URL in an env variable and runs it | The second variant: a small block that decodes a URL, downloads code and runs it. | forkguard fix removes that block. |
| "dev" runs a hidden file called init before your real command | A package.json script runs the loader first. | forkguard fix removes just that step. |
| Pretends to be a font but is actually code | A .ttf or .woff2 file that is JavaScript. | forkguard fix deletes it. |
| Decoy fonts folder planted to hide the fake font | A fonts folder with a fake font and a planted README. | forkguard fix deletes the folder. |
| VS Code task runs a hidden command the moment you open the folder | A .vscode/tasks.json task that starts on folder open. | forkguard fix removes that task. |
| File this malware drops to spread itself | config.bat, temp_auto_push.bat or a .orc file. | forkguard fix deletes it. |
| Depends on … a known malicious package | A dependency on a package known to carry the payload. | Remove it from package.json and reinstall. Treat the machine that installed it as exposed. |
| npm itself is infected | npm on this computer carries the payload. | Reinstall Node.js from nodejs.org before running npm again. |
| Commit … was rewritten: same time, different timezone | Your latest commit was amended after you made it. | Clean the repo and push the clean version. See Cleaning an infected project. |
| Secret file is committed to the repo | A .env file is in git. | forkguard pr removes it from git. Rotate whatever is in it. |
| Secret file is not in .gitignore | A .env file could be committed by accident. | forkguard fix adds the rule. |
Every rule in full: What it catches.
#“Looks clean” is not a guarantee
forkguard finds the tricks it knows. A clean result means none of those tricks are present, not that the project is safe. Read Safety and privacy for what it cannot do.