CloneGuard Tool Scans Repositories for Credential-Stealing Code Before Running

·2 views

A new open-source project called CloneGuard has been shared on Hacker News, aiming to help developers inspect code repositories. The tool is designed to scan a repository for techniques commonly used to steal credentials. It is meant to be run before a cloned project is executed on a user's machine. The project is hosted on GitHub, and the discussion received a modest response on Hacker News at the time of posting. The source material provides limited detail beyond the project's purpose and links.

Read the full story at Hacker News

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to find a reference when you only remember what something was like

The piece describes a common frustration: knowing something exists but being unable to recall its name, which makes standard search ineffective because queries are descriptions rather than titles. It argues that references indexed by the thing itself, rather than by a description, close this gap. Two approaches are highlighted: a relationship view that shows who characters stand next to, exemplified by FandomGraph, and an ingredient view that starts from an item, exemplified by HowToCraft. The author contends that the key test for any lookup resource is whether a person who only remembers what something is like can still find it. Both views exist because they serve cases where a description is all the visitor has.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Minecraft plugin developer's leaked paid jar: how to trace the buyer and revoke copies

A developer who finds their premium Minecraft plugin shared on a leak forum can follow a set sequence of steps. The guide warns that leaked "cracked" files often contain malware, so they should only be inspected in an isolated environment. If each buyer received a unique copy, the buyer can be identified via embedded license keys or watermarks, then matched against the license server's records. Plugins with periodic license re-checks can have revoked keys shut down copies already running on servers. The advice also covers reviewing the suspect buyer's history, handling refunds or chargebacks, and filing DMCA takedowns against leak sites.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Offboarding and Insider Access Are Now National Security Concerns for Engineering Teams

An article on DEV Community argues that engineers with legitimate access to sensitive assets such as AI model weights and chip designs can be targets for coercion, recruitment, or deception. It describes three categories of insider risk: malicious insiders, coerced employees, and those compromised through identity fraud or remote-hiring gaps. The author recommends time-boxed access instead of standing permissions, and automated offboarding tied to HR termination events. The piece also cautions against a surveillance-heavy culture and suggests treating open source dependencies with the same scrutiny.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Free Lua obfuscation guide for protecting paid FiveM scripts

Sellers of FiveM scripts risk buyers reading and copying their .lua source files, which is why obfuscation is recommended. The guide explains that Tebex asset escrow already encrypts files, so obfuscation mainly targets unescrowed files and resources sold outside escrow, and that Cfx.re's Releases section bans third-party obfuscation. Obfuscation makes code harder to read and edit but does not stop determined users, so per-buyer license keys are suggested for sharing control. Because Prometheus outputs Lua 5.1 while FiveM uses Lua 5.4, files with 5.4-only syntax must be identified with a grep command and excluded. The article demonstrates using the SunLicense service's free tier, which includes three obfuscation runs per month, to process a resource while preserving exports, events, and NUI callbacks.

0 comments Read more at DEV Community