I built GiTRay — a free tool to check GitHub repositories for suspicious code before you run them
Hey everyone!
I’m building GiTRay, a free tool that helps you spot potential malware and suspicious behavior in GitHub repositories before you install or run anything.
Paste a GitHub repository URL, and GiTRay scans its contents without cloning, building, or executing the code. It highlights what it finds and points you to the relevant files and lines so you can investigate.
Some of the things it checks for:
- Scripts that run automatically during installation or when you open a project.
- Suspicious code that accesses credentials or sends sensitive data elsewhere.
- Hidden or obfuscated code and download-and-execute patterns.
- Dependencies flagged as known malware.
- Suspicious binaries, download links, and instructions to disable your antivirus.
The idea is to make unfamiliar repositories easier to inspect, whether you’re trying a new tool, checking a coding assignment, or exploring a project someone sent you.
It’s free to use: https://www.gitray.net/en
It’s still in development, and it can miss threats or flag legitimate code. A clean result doesn’t guarantee safety—think of it as an extra check to help you decide what deserves a closer look.
I’d love to hear your feedback, especially if you find confusing results, false positives, or something it should detect!
