GitHub - tharun208/cloneguard: Scan a repo for malware tricks before you run it. Catches credential theft, hidden network calls, obfuscated code and auto-run hooks. Read-only, with no dependencies.

GitHub has launched CloneGuard, a read-only, dependency-free tool from developer tharun208 that scans repositories for malware tricks before code is run, catching credential theft, hidden network calls, obfuscated code and auto-run hooks. The tool arrives as developers increasingly pull third-party code and AI-generated dependencies into their workflows, expanding the attack surface for supply-chain compromises. CloneGuard's zero-dependency design means it can run in any environment without setup, lowering the barrier to pre-execution checks. It matters because most security tooling inspects code after installation, while CloneGuard targets the moment before a repository is trusted. Next, watch whether GitHub folds the scanner into its broader code-quality and Actions tooling, and whether adoption spreads beyond individual developers to team-level CI pipelines.