{"id":16202233,"url":"https://github.com/mathiscode/codebase-scanner","last_synced_at":"2025-03-19T05:31:10.811Z","repository":{"id":190312903,"uuid":"682362815","full_name":"mathiscode/codebase-scanner","owner":"mathiscode","description":"Scan a codebase for malware signatures","archived":false,"fork":false,"pushed_at":"2025-03-17T01:45:14.000Z","size":31,"stargazers_count":17,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-03-17T01:49:52.112Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mathiscode.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-08-24T02:30:53.000Z","updated_at":"2025-03-17T01:45:18.000Z","dependencies_parsed_at":"2024-05-07T07:41:38.692Z","dependency_job_id":null,"html_url":"https://github.com/mathiscode/codebase-scanner","commit_stats":null,"previous_names":["mathiscode/codebase-scanner"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mathiscode%2Fcodebase-scanner","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mathiscode%2Fcodebase-scanner/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mathiscode%2Fcodebase-scanner/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mathiscode%2Fcodebase-scanner/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mathiscode","download_url":"https://codeload.github.com/mathiscode/codebase-scanner/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244364802,"owners_count":20441459,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-10T09:46:32.275Z","updated_at":"2025-03-19T05:31:10.797Z","avatar_url":"https://github.com/mathiscode.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003c!-- markdownlint-disable MD033 --\u003e\n\n# Codebase Scanner\n\n[npm](https://www.npmjs.com/package/@mathiscode/codebase-scanner)\n\n[Docker Hub](https://hub.docker.com/r/mathiscode/codebase-scanner)\n\nA quick and dirty tool to help defend against common developer-focused malware campaigns since many of these go unnoticed by common antivirus software.\n\nWhen a signature is found, the filename is printed to the console and optionally fixed (if `--fix` is passed). When fixing, a header is prepended to the file to prevent the malware from running or being imported. This may not be foolproof, so always exercise caution and do everything possible to avoid letting the codebase run any scripts.\n\nInspired by [this experience](https://www.reddit.com/r/Upwork/comments/14nat71/scam_warning_blockchain_developer_job_postings) (obfuscated Javascript steals your browser profiles and other files via a \"test task\" on freelancing sites, hidden within a seemingly innocuous codebase).\n\nCurrently the signatures only target this specific type of Javascript malware, but more will be added over time. Signatures may be added for other file types as well.\n\n**PRs welcome!**\n\nHave you found a new signature? Please submit a PR with the signature added to [`signatures.js`](signatures.js) and a sample file attached in a comment.\n\nTo further examine some of these malicious codebases, check out [this repository](https://github.com/rubenmarcus/malicious-repositories).\n\n## Usage\n\nScan a repository in a Docker container:\n\n```bash\ndocker run -it --rm mathiscode/codebase-scanner:latest\n# Enter the repo url: https://github.com/owner/repo\n# ☠️ Found signature Obfuscated Javascript (Buffered \"child_process\") in file /path/to/codebase/malware.js\n```\n\nScan a local codebase:\n\n```bash\n# Just scan\nnpx @mathiscode/codebase-scanner@latest /path/to/codebase\n# ☠️ Found signature Obfuscated Javascript (Buffered \"child_process\") in file /path/to/codebase/malware.js\n```\n\n```bash\n# Scan and fix\nnpx @mathiscode/codebase-scanner@latest --fix /path/to/codebase\n# ☠️ Found signature Obfuscated Javascript (Buffered \"child_process\") in file /path/to/codebase/malware.js\n# ⚠️ Detected and modified file /path/to/codebase/malware.js - review immediately\n```\n\n## Malicious File Header\n\nWhen a file is fixed, the following header is prepended to the file:\n\n\u003cpre\u003e\n========= MALICIOUS =========\nThis file has been flagged as malicious by https://github.com/mathiscode/codebase-scanner\nPlease review the file and remove these lines if appropriate.\n========= MALICIOUS =========\n\u003c/pre\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmathiscode%2Fcodebase-scanner","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmathiscode%2Fcodebase-scanner","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmathiscode%2Fcodebase-scanner/lists"}