I Stopped Trusting npm install, So I Built a Pre-Clone GitHub Security Scanner

We trust open source every single day.
Every time we clone a repository, we usually do something like this:

git clone https://github.com/user/project.git
cd project
npm install

Simple.

But recently, that workflow has started making me uncomfortable.

The Problem

Over the last year, we've seen a growing number of software supply-chain attacks targeting developers.

Malicious packages.
Credential stealers.
Obfuscated payloads.
Lifecycle scripts that execute automatically during installation.

Sometimes all it takes is running:
npm install

• before you've even had a chance to inspect the code.
• As developers, we're careful about clicking suspicious links or downloading random executables.
• Yet many of us still clone unfamiliar repositories and install dependencies almost immediately.

That got me thinking:

Why isn't there a simple way to inspect a repository before it reaches my machine?

The Idea

I wanted something that could answer one question:

"Is this repository safe enough to clone?"

• Not after installation.
• Not after executing scripts.
• Before anything runs. So I started building GitScout.

A static security scanner written entirely in Go that analyzes public GitHub repositories in a few seconds and reports potentially dangerous patterns.

Github repo : https://github.com/Adityazzzzz/GitScout