Quick start

From zero to protected in five steps.

On this page

1. Check the project you are in
2. Read the result
3. Clean it
4. Fix it on GitHub too
5. Turn on automatic protection
Cheat sheet
Where to next

#1. Check the project you are in

Open a terminal inside the project folder and run:

forkguard

A clean project looks like this:

Output

forkguard  my-app looks clean (433 files checked)

#2. Read the result

If something is wrong you get a list. Each line has a level, a file and a message:

Output

forkguard  my-app

  HIGH  init                Code hidden after 776 blank spaces on line 35
  HIGH  package.json        "dev" runs a hidden file called init before your real command
  MED   .gitignore          Hides config.bat, a file this malware drops

  3 problems found. Do not run npm install, npm run dev or open this folder in VS Code yet.
  Run forkguard fix to clean it, or forkguard pr to clean it and open a pull request.

Level	Meaning	What to do
HIGH	Dangerous. It can run by itself and steal from you.	Do not install, run or open the project. Clean it first.
MED	Worth a look. It does not run by itself.	Read it and decide. Most can be fixed with `forkguard fix`.

#3. Clean it

forkguard fix

Output

forkguard  cleaning my-app

  done  init                deleted
  done  package.json        cleaned
  done  postcss.config.mjs  restored your original from git history

  Clean now. Review with "git diff", then commit.

Look at what changed, then save it:

git diff
git add -A
git commit -m "Remove injected malware"

#4. Fix it on GitHub too

forkguard fix cleans your computer. forkguard pr cleans GitHub as well, by opening a pull request with the fix:

gh auth login
forkguard pr

Commit or stash your own changes first. Details in `forkguard pr`.

#5. Turn on automatic protection

npm install -g forkguard
forkguard setup

Close the terminal and open a new one. From now on forkguard checks a project before npm install, npm run dev and friends, and after git clone. When everything is clean you see nothing at all.

#Cheat sheet

I want to…	Run
Check this folder	`forkguard`
Check another folder	`forkguard path/to/project`
Check a GitHub repo without cloning it	`forkguard owner/repo`
Check all my repos on GitHub	`forkguard --mine`
Clean this folder	`forkguard fix`
Clean it on GitHub with a pull request	`forkguard pr`
Send the fix to the repo I forked from	`forkguard pr --upstream`
Check automatically before npm and after git	`forkguard setup`
Turn automatic checks off	`forkguard setup --remove`
Skip the check once	`FORKGUARD_SKIP=1 npm install`
Get results as JSON	`forkguard --json`
Add safety rules for AI agents (next release)	`forkguard agent --write`
See the version	`forkguard --version`

Where to next

Edit this page on GitHub View as Markdown