Developer Builds Static Scanner to Catch Supply-Chain Malware Before Code Runs

A developer created a static repository scanner after being targeted by a fake job interview repo designed to steal credentials and API keys. The tool analyzes repositories without cloning, installing, or executing any code, since malicious scripts embedded in npm lifecycle hooks like postinstall can run automatically during npm install. The scanner checks for three key threat categories: dangerous build-time execution hooks, dependencies in package.json that resolve to unexpected or non-registry URLs in the lockfile, and obfuscation patterns such as eval of decoded strings or long hex literals. The attack that inspired the tool exploited a mismatch between a trusted-looking package name and a malicious tarball URL hidden in the lockfile. By keeping analysis logic free of any I/O and testable against known-malicious fixtures, the scanner can flag suspicious combinations of signals before any harm is done.