GiTRay: Free Tool Scans GitHub Repositories for Suspicious Code Before Running

·6 views

A developer has released GiTRay, a free web tool designed to help users identify potential malware in GitHub repositories before installing or running them. Users paste a repository URL, and the tool scans the contents without cloning, building, or executing any code. It flags items such as install-time or auto-run scripts, code that accesses credentials or sends data elsewhere, obfuscated download-and-execute patterns, and dependencies known to be malicious. The creator notes the tool is still in development and may miss threats or flag legitimate code, so a clean result is not a guarantee of safety. The developer is requesting user feedback, particularly on confusing results and false positives.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Inertia 3.11 live props let pages refresh on server events without polling

A page showing an order as "Preparing" stays stale after the kitchen marks it ready, forcing customers to refresh. Common workarounds are polling the server or subscribing to a channel and reloading manually, which duplicates logic and fails to recover after dropped connections. Inertia 3.11 introduced live props, where the server declares which channels and events signal a prop has changed, and the browser refetches only that prop when one arrives. The author maintains Guren, a TypeScript fullstack framework on Bun and Hono, which added support for live props in version 2.36 via a live() helper and a WebSocket-based transport. The post walks through a small diner demo with a kitchen board and a customer tracking page, showing setup of broadcasting, a socket route, the client transport, and an OrderUpdated event; the demo's page updated within about 0.12 to 0.17 seconds of each click.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

osFoundry requires Claude Code to pin a commit when requesting a GitNest check rerun

osFoundry's MCP endpoint exposes a propose_gitnest_check_rerun tool that Claude Code calls to ask for a finished GitNest check to be retried. The tool requires six fields, including an expected change-set version and composition commit, so approval can recheck that the repository state has not moved. The author explains that GitNest's UI reduces check runs to a status using ordered rules where no runs means none, any failure means failed, and only full success means passed. A test script shows that naive shortcuts, such as treating the absence of failures as green, give wrong verdicts in 5 of 7 cases. The author therefore recommends that agents report individual check states rather than a single green verdict.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Idempotent Webhook Handling and Audited Recovery for Logistics Shipment Events

A design proposal describes how a logistics webhook consumer can process shipment status events exactly once during outages. Each request is authenticated and bound to a tenant before any deduplication occurs, so unauthorized senders cannot reserve event IDs. Deduplication relies on a database uniqueness constraint over the authenticated source, tenant, and event ID, with the deduplication record, shipment update, and audit entry committed in one transaction before acknowledgement. The author notes that a preliminary lookup is insufficient under concurrency, since the constraint must decide which of two simultaneous deliveries proceeds. The approach does not make remote side effects transactional or guarantee delivery order, and a failed database write must withhold success acknowledgement.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Attributing AI Gateway Spend by Service Using Stateful Actors

An AI gateway bill shows total spend but not which service, environment, or tenant caused a sudden rise, which matters when several applications share one gateway. Attribution Wheel, an open-source TypeScript sample running on Telnyx Edge Compute, addresses this by attaching metadata such as service, environment, and tenant to each request via the x-ltg-metadata header. It groups spend by these dimensions, stores one daily ledger row per service, and compares each service against its own seven-day baseline. When a new anomaly appears, the system can send an SMS alert to an on-call number. The design uses one Stateful Actor per AI Gateway token group, a SQL ledger keyed by date and service to prevent duplicate rows, and a demo mode for testing without real traffic or alerts.

0 comments Read more at DEV Community