I Stopped Trusting npm install, So I Built a Pre-Clone GitHub Security Scanner

Aditya Singh — Thu, 30 Jul 2026 16:50:51 +0000

We trust open source every single day.
Every time we clone a repository, we usually do something like this:

git clone https://github.com/user/project.git
cd project
npm install

Simple.

But recently, that workflow has started making me uncomfortable.

The Problem

Over the last year, we've seen a growing number of software supply-chain attacks targeting developers.

Malicious packages.
Credential stealers.
Obfuscated payloads.
Lifecycle scripts that execute automatically during installation.

Sometimes all it takes is running:
npm install

before you've even had a chance to inspect the code.
As developers, we're careful about clicking suspicious links or downloading random executables.
Yet many of us still clone unfamiliar repositories and install dependencies almost immediately.

That got me thinking:

Why isn't there a simple way to inspect a repository before it reaches my machine?

The Idea

I wanted something that could answer one question:

"Is this repository safe enough to clone?"

Not after installation.
Not after executing scripts.
Before anything runs. So I started building GitScout.

A static security scanner written entirely in Go that analyzes public GitHub repositories in a few seconds and reports potentially dangerous patterns.

Github repo : https://github.com/Adityazzzzz/GitScout

DEV Community: Aditya Singh

I Stopped Trusting npm install, So I Built a Pre-Clone GitHub Security Scanner

The Problem

The Idea