{"id":50706184,"url":"https://github.com/raalarcon9705/detect-project-malware","last_synced_at":"2026-06-09T12:01:45.658Z","repository":{"id":352947980,"uuid":"1217330788","full_name":"raalarcon9705/detect-project-malware","owner":"raalarcon9705","description":"Agent skill that scans a project for supply-chain and infostealer patterns across JS/TS, Python, shell, configs and package.json. Works with Claude Code, Codex, Cursor, Gemini CLI, Antigravity and 40+ other agents.","archived":false,"fork":false,"pushed_at":"2026-04-21T19:36:14.000Z","size":21,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-04-21T21:35:37.207Z","etag":null,"topics":["agent-skill","antigravity","claude-code","codex","cursor","gemini-cli","incident-response","infostealer","malware-detection","ripgrep","security-scanner","skill-md","skills-sh","static-analysis","supply-chain-security"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/raalarcon9705.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-04-21T19:26:27.000Z","updated_at":"2026-04-21T19:49:49.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/raalarcon9705/detect-project-malware","commit_stats":null,"previous_names":["raalarcon9705/detect-project-malware"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/raalarcon9705/detect-project-malware","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/raalarcon9705%2Fdetect-project-malware","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/raalarcon9705%2Fdetect-project-malware/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/raalarcon9705%2Fdetect-project-malware/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/raalarcon9705%2Fdetect-project-malware/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/raalarcon9705","download_url":"https://codeload.github.com/raalarcon9705/detect-project-malware/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/raalarcon9705%2Fdetect-project-malware/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34105565,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-09T02:00:06.510Z","response_time":63,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["agent-skill","antigravity","claude-code","codex","cursor","gemini-cli","incident-response","infostealer","malware-detection","ripgrep","security-scanner","skill-md","skills-sh","static-analysis","supply-chain-security"],"created_at":"2026-06-09T12:01:40.940Z","updated_at":"2026-06-09T12:01:45.652Z","avatar_url":"https://github.com/raalarcon9705.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# detect-project-malware\n\nAn AI agent [Skill](https://skills.sh/) that audits an entire project for\nsupply-chain and infostealer patterns **without executing any of the suspect\ncode**. It works as a `SKILL.md` — compatible with Claude Code, Codex, Cursor,\nOpenCode, Gemini CLI, Antigravity, and 40+ other agents that implement the\n[Agent Skills open standard](https://github.com/vercel-labs/skills).\n\nBuilt after a real incident where a contributor injected an obfuscated\ncredential-stealing payload into `postcss.config.js`, got it reverted, and\nre-injected it weeks later behind an unrelated feature commit. The skill\nautomates the detection and the git-history attribution so the same class of\nattack can be caught in seconds instead of days.\n\n## What it catches\n\nCovers JS/TS/JSX/TSX, Python, shell (bash/zsh/fish), Ruby, Go, PHP, Perl,\nPowerShell, Dockerfiles, Makefiles, YAML, `package.json` install hooks, and all\nJS/TS tooling configs. Groups hits into 14 categories:\n\n- `JS_OBFUSCATION`, `JS_EVAL`, `JS_ESM_ESCAPE`, `JS_NATIVE_EXEC`\n- `PY_EVAL`, `PY_NATIVE_EXEC`, `PY_REVERSE_SHELL`\n- `SHELL_REMOTE_EXEC` — `curl | sh`, `bash \u003c(curl …)`, `base64 -d | bash`, …\n- `SHELL_REVERSE_SHELL` — `/dev/tcp/…`, `nc -e`, `bash -i \u003e\u0026 /dev/tcp/…`\n- `SHELL_PERSISTENCE` — `.bashrc` / `authorized_keys` / crontab / LaunchAgents / systemd\n- `SHELL_DISABLE_SECURITY` — `setenforce 0`, `chattr -i`, iptables flush\n- `CRED_BROWSER`, `CRED_SSH`, `CRED_CLOUD`, `CRED_TOKENS`, `CRED_WALLETS`,\n  `CRED_PRIVATE_KEYS`, `CRED_DISCORD`\n- `NET_EXFIL` — Telegram bots, Discord/Slack webhooks, ngrok/transfer.sh, DNS beacons\n- `MINING` — stratum, xmrig, coinhive, etc.\n- `SUPPLY_CHAIN` — `postinstall` / `preinstall` / `prepare` hooks that fetch or exec\n- `CONFIG_ANOMALY` — oversized single lines in config files (classic payload hiding spot)\n\nSee [PATTERNS.md](PATTERNS.md) for the full catalog with severity and typical\nfalse-positive shapes.\n\n## Install\n\n### Via the `skills` CLI (Vercel Labs, works with 45+ agents)\n\n```bash\nnpx skills add raalarcon9705/detect-project-malware\n```\n\nThis auto-detects your installed agents (Claude Code, Codex, Cursor, OpenCode,\nGemini CLI, Antigravity, …) and places the skill in each agent's skills\ndirectory. Install for a specific agent only:\n\n```bash\nnpx skills add raalarcon9705/detect-project-malware --agent claude-code\nnpx skills add raalarcon9705/detect-project-malware --agent codex\nnpx skills add raalarcon9705/detect-project-malware --agent cursor\n```\n\n### Manual install\n\nClone the repo into the skills directory of your agent of choice:\n\n| Agent          | Path                                       |\n| -------------- | ------------------------------------------ |\n| Claude Code    | `~/.claude/skills/detect-project-malware`  |\n| Codex          | `~/.codex/skills/detect-project-malware`   |\n| Cursor         | `~/.cursor/skills/detect-project-malware`  |\n| Gemini CLI     | `~/.gemini/skills/detect-project-malware`  |\n| Antigravity    | `~/.antigravity/skills/detect-project-malware` |\n| Generic        | `~/.agents/skills/detect-project-malware`  |\n\n```bash\ngit clone https://github.com/raalarcon9705/detect-project-malware.git \\\n  ~/.claude/skills/detect-project-malware\n```\n\n## Usage\n\nOnce installed, tell your agent:\n\n\u003e Scan this repo for malware / supply-chain issues\n\nOr invoke the scripts directly from any project root:\n\n```bash\nbash ~/.claude/skills/detect-project-malware/scripts/scan.sh\n```\n\nTypical output:\n\n```\n=== detect-project-malware scan ===\nroot:    /Users/you/Development/your-repo\nscanned: 713 file(s) in 2s\nresult:  3 suspicious file(s)\n\nCategories seen:\n  CRED_TOKENS             2 match(es)\n  JS_ESM_ESCAPE           1 match(es)\n\n● /Users/you/Development/your-repo/postcss.config.js\n    [JS_ESM_ESCAPE] createRequire\n● /Users/you/Development/your-repo/test-goals.sh\n    [CRED_TOKENS] jwt-candidate\n```\n\nFor any hit, attribute the injection commit:\n\n```bash\nbash ~/.claude/skills/detect-project-malware/scripts/find-injection.sh \\\n  path/to/file.js --root .\n```\n\nProduces a CLEAN / INFECTED / INJECTED / CLEANED history walk plus the exact\n`git show` command to restore the last clean version.\n\n## Repository layout\n\n```\ndetect-project-malware/\n├── SKILL.md            ← entry point (YAML frontmatter + workflow)\n├── PATTERNS.md         ← category catalog with severity \u0026 FP guidance\n├── SECURITY.md         ← threat model \u0026 how the scripts are safe to run\n├── scripts/\n│   ├── scan.sh         ← ripgrep-based, multi-language scanner\n│   ├── patterns.txt    ← editable rule catalog (CATEGORY|name|regex)\n│   └── find-injection.sh ← git-history attribution for a single file\n├── LICENSE\n└── README.md\n```\n\n## Requirements\n\n- [ripgrep](https://github.com/BurntSushi/ripgrep) (`rg`) — the scanner uses it\n  for the fast file traversal and pattern matching.\n- `bash` 3.2+ (scripts tested against macOS default bash and modern Linux).\n- `git` 2.0+ (only for `find-injection.sh`).\n\n## How it's safe to run\n\nNone of the scripts ever `source`, `eval`, `node`, `python`, `bash`, or\notherwise execute a suspect file. They only **read** content through ripgrep\nand `awk`. Safe to point at a repo you already suspect is compromised.\n\nSee [SECURITY.md](SECURITY.md) for the threat model, scope, and what the skill\nexplicitly does **not** do.\n\n## Contributing\n\nPatterns live in `scripts/patterns.txt`. Format per line:\n\n```\nCATEGORY|name|regex\n```\n\nLines starting with `#` and blank lines are skipped. Regex flavor: ripgrep\ndefault (Rust regex, no look-around). When adding a new pattern, update\n`PATTERNS.md` with a severity note and typical false-positive shape.\n\n## License\n\n[MIT](LICENSE) © 2026 Reynier Rivero\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fraalarcon9705%2Fdetect-project-malware","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fraalarcon9705%2Fdetect-project-malware","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fraalarcon9705%2Fdetect-project-malware/lists"}