Detect trojan source attacks that employ unicode bidi attacks to inject malicious code

`lavamoat` is a NodeJS runtime where modules are defined in [SES][SesGithub] Compartments. It aims to reduce the risk of malicious code in the app dependency graph, known as "software supply chain attacks".

Scan AI agent skills for prompt injection and malicious code

Detect malicious code

OpenClaw Skills security scanner plugin - detect malicious code, data exfiltration, and prompt injection

Security scanner for detecting malicious code patterns in repositories

Pre-install security analysis CLI for npm packages. Analyze packages before installation to detect vulnerabilities, malicious code, typosquatting, and supply chain attacks.

Comprehensive security firewall for Node.js applications - Blocks 100% of supply chain attacks, credential exfiltration, and malicious code execution

Security checker for Claude Code skills - detect injection, malicious code, and supply chain risks before installation

This is only published to prevent duplicate or malicious code

This is only published to prevent duplicate or malicious code

Eval untrusted and possibly malicious code.

Static and runtime security guard for the DeepSeek Harness: scans plugins and workspaces for malicious code, context injection and token waste (block/warn/clean), intercepts dangerous runtime tool calls and prompt steps, and exposes /scan, plugin_scan, th

Security scanner for MCP servers — detect tool poisoning, malicious code patterns, and supply-chain risks before your AI agents execute them.

Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.

Security scanner for npm packages - pre and post-install scanning for malicious code, supply chain attacks, and obfuscated code

Versions 2.0.4 and 2.0.5 of this package were published with malicious code on 15 September 2025, when the npm account that publishes it was compromised in the Shai-Hulud supply-chain campaign. The registry removed them from npm; they cannot be installed.

Local-first security scanner for AI Skills (Anthropic Skill bundles, Newmax, OpenClaw, MCP, GPTs Actions). Catches malicious code, supply-chain attacks, and prompt injection — pure static analysis, sub-2s, zero LLM cost.

Versions 2.0.7 and 2.0.8 of this package were published with malicious code on 15 September 2025, when the npm account that publishes it was compromised in the Shai-Hulud supply-chain campaign. The registry removed them from npm; they cannot be installed.

GraphQL IDE for better development workflows (GraphQL Subscriptions, interactive docs & collaboration).