Security Tips and Tools To Keep You Safe

AI is moving at a breakneck speed, with new tools and apps dropping daily. One way to keep up is social media, but you have to be careful. Accounts post suspicious or dangerous software including phishing, malware, obfuscated code whether knowingly or sometimes by mistake. The security compromise lands on you either way.

This should go without saying, but do not blindly pull and run code just because an account you follow recommends it. I've seen reputable accounts post GitHub repos that turned out to be genuinely sketchy. A few things worth doing before you clone anything: review the repo owner's profile to see if they have other legitimate work, and look at the commit history. A single commit or a trail of nothing but README updates is a red flag. Beyond that, there are tools built specifically to catch what manual review might miss.

GuardDog is a CLI tool from Datadog that identifies malicious PyPI and npm packages, Go modules, Rust crates, RubyGems, GitHub Actions, and VSCode extensions. It runs static analysis on package source code through YARA rules and analyzes package metadata to detect supply chain attacks. What separates it from simpler scanners is that it correlates findings rather than just listing suspicious patterns. A package gets flagged as high risk only when it has both the capability to perform an action (like network access) and a threat indicator (like a suspicious domain) in the same file.

ghsafe takes a similar approach but focuses specifically on GitHub repositories. It scans a repo for malicious patterns before you clone and run it, which is exactly the workflow that catches people off guard. A friend of mine ran into the real-world version of this: a LinkedIn message, someone pretending to be from a well-known tech company, a GitHub repo framed as a normal coding exercise. He reviewed the code first and found hidden data exfiltration, environment variable theft, and obfuscated payloads buried inside. Not everyone slows down to look. ghsafe is designed for the cases where you might not, scanning for phishing repos disguised as job opportunities, malware hidden in postinstall scripts, credential theft targeting SSH keys and API tokens, crypto miners embedded in otherwise normal-looking projects, and backdoors with persistence mechanisms. You can install it directly from npmjs.com.

Happy open-source hunting and stay safe out there! 🤘🚀