Pulls public metadata and file contents straight from the GitHub API in your browser, then greps for the patterns that show up in credential stealers, wallet drainers, and curl-into-shell installers. No login, no cloning, nothing runs. Heuristic only — a clean scan is not a guarantee.
Reads public repo data only. Unauthenticated GitHub API calls are capped at 60/hour per IP — plenty for occasional checks.
Risk Signal
—
How to read a flag
Every flag below just means "this exact pattern showed up" — it's not a verdict by itself. Each one now includes a few lines of surrounding code and a direct link to that exact line on GitHub, so you can trace it without leaving this page.
Read the highlighted line plus the context above it — code doesn't usually explain itself in one line, so the lines before it are where the actual answer lives (e.g. where a variable's value came from).
Click "view on GitHub ↗" if you want to see more of the file than the context box shows, or check the commit history for that line.
Open "How to check this yourself" under any flag for a specific plain-language walkthrough for that type of pattern.
The question to always land on: does the risky part (a command, a URL, a value being sent somewhere) come from the project's own code/config, or from something outside it — user input, a webpage, an API response? Local and self-contained is normal. External and uncontrolled is the actual risk.