PR Malware Guard for GitHub

Warns you when a GitHub pull request, commit or compare view adds code that matches known supply-chain malware patterns.

PR Malware Guard checks the code changes you open on GitHub and warns you before you merge, check out, or open a malicious change in your editor. It was built after a real campaign that hid a loader in repositories through pull requests and commits, including "cleanup" pull requests that removed one copy of the malware and added a new one. When you view a pull request's Files changed tab, a commit, or a compare view, the extension looks at the added lines and shows: • A red banner listing each finding with the file, the rule and its severity • A badge on each affected file • A green notice when nothing known was found What it looks for (15 rules in version 1.0.0): • A one-line root api.js that hides code after a long run of spaces • Code pushed off-screen after 150+ spaces or blank lines • Files named like fonts (.otf, .woff2) that actually contain JavaScript • .vscode/tasks.json tasks that run when a folder is opened, and settings that allow them • npm scripts such as "node api.js && next dev" • Indicators from this campaign: its wallet address, its on-chain lookup and decode-and-run loaders, and known variant markers • Pull request titles used by the fake cleanup pull requests Privacy: all checks run in your browser. The extension only talks to github.com and raw.githubusercontent.com, using your existing GitHub session to read the files of the change you are viewing (this also works for private repositories you can already see). It has no analytics, loads no remote code, and sends nothing to anyone. You can turn scanning or individual rules off from the popup and the options page. The interface is available in English and Bangla. A clean result means no known pattern matched. It does not prove a change is safe, so keep reviewing code as usual. Source code and rules: https://github.com/SahinurDEV/pr-malware-guard