is-malicious
CLI that scans source, build and CI files with Jev for hidden, deceptive or data-stealing behavior before you run unfamiliar code.
Overview
is-malicious is a Node CLI that sends a project's source, configuration, build and CI files to Jev and reports suspicious files and line ranges before you run the code. It checks areas such as credential theft, unexpected data uploads, covert fingerprinting, surveillance, hidden network activity, downloading and running hidden code, and remote commands, while ordinary credential use and documented services should score low. Per the yibie list, suspicious chunks are escalated for a second pass.
Findings include file, line range, category, probability, confidence and a short reason, and telemetry is reported separately as info. Exit codes distinguish clean, high-severity and failed or partially skipped scans, making it usable in scripts. It can target any service implementing the TypeSafe /v1/systemone API via --base-url and --model. The README is explicit that a clean report is not proof of safety, that both high and low scores can be wrong, and that scans use paid input tokens, reporting usage and cost.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Yes / no | Does this file chunk contain covert, deceptive or data-stealing behavior?(inferred) | yes · no |
| Choice | Which category of suspicious behavior does this finding fall into?(inferred) | data theft and collection · network and execution · ... |
How it works
- Collect source, config, build and CI files and chunk them
- Ask Jev Noul checks per chunk
- Escalate suspicious chunks for a second pass
- Report files, lines, category, probability and reason
- Exit 1 on high-severity findings, 2 on errors or skipped chunks
Strengths
- Quick second opinion before running untrusted code
- Points to specific files and lines to review first
- Works with any compatible /v1/systemone provider
- Reports token usage and input cost
Caveats
- A clean report is not proof a project is safe
- Sends file contents to the configured endpoint
- Paid per input token
Getting started
With Node 20+: `export TYPESAFE_API_KEY=...` then `npx is-malicious /path/to/project`.At a glance
- Type
- CLI
- Status
- beta
- Language
- TypeScript
- Runtime
- Node CLI
- Has code
- yes
- License
- MIT
Use cases and integrations
How curated lists describe it
Software supply-chain security: asks Jev `Noul` checks about source and build files, escalates suspicious chunks for a second pass, and returns implicated files and lines before execution.
yibie/awesome-jevCLI security scanner using Jev to inspect source files, build scripts, and CI configs for suspicious patterns before execution.
logicrw/awesome-jev-projectsScans source, configuration, build, and CI files with Jev, then reports suspicious behavior and implicated lines before the code is run.
cobanov/awesome-jevScans a codebase for covert, deceptive, or data-stealing behavior with Jev, then reports suspicious files and line ranges before the user runs it.
hellogumbo/awesome-jevSends source, configuration, build, and CI files to Jev and points at the files and lines that look deceptive or data-stealing. Its README says a clean report is not proof a project is safe.
MrJev/awesome-jev
Frequently asked questions
What does is-malicious decide?
Whether chunks of a codebase show covert, deceptive or data-stealing behavior, with a category and probability.
Is a clean scan a guarantee?
No. The README says a clean report is not proof that a project is safe.
Can I use a local model?
Yes, any service implementing POST /v1/systemone via --base-url and --model.
Related projects
Unix-style tools where Jev learns a repo's decision norms and judges each node of a code lead as a bug, lead or clean.
ProjectbetaJavaScriptRust code and security reviewer that asks Jev staged questions about diffs and posts findings with severity and owner routing.
ProjectbetaRustSemantic code linter that reads each method with its callers and callees and asks decision models about defects, kind, line and severity.
CLIbetaTypeScriptStaged code-review workflow for JS/TS where Jev screens risk, picks evidence, classifies mechanism, scores severity and routes reviewers.
AppprototypeTypeScriptProof-of-concept scanner that asks Jev hundreds of bug questions per Solidity file and writes a heat map of likely vulnerabilities.
ProjectprototypePythonRust CLI that classifies Git commit diffs with Jev into bug fixes, security fixes with CWEs, and change types.
CLIbetaRust