RepoGuard scans every commit for malicious code, blocks dangerous pushes, and opens fix pull requests automatically — before damage reaches your default branch.
Results shown in GitHub check runs and pull requests — no CLI required
RepoGuard plugs into GitHub's event system. No configuration required — it starts scanning the moment you install it.
One click from the Marketplace. Grant repository access and RepoGuard immediately scans your entire codebase for existing threats.
Each commit triggers a scan of changed files. A GitHub Check Run reports the result — clean or blocked — directly in your pull request.
When issues are found, RepoGuard opens a detailed pull request with the patches applied, findings explained, and your repo admins requested as reviewers.
Unlike traditional vulnerability checkers, RepoGuard focuses directly on active developer supply chain threat vectors.
| Security Feature | RepoGuard | Dependabot | GitHub CodeQL |
|---|---|---|---|
| Instant scan-on-push hooks | Yes (Blocked) | No (Periodic) | Yes (CI Action) |
| Malware injection rules (RCE, shells) | Full coverage (23+) | None (CVE database only) | Partial static patterns |
| Package typosquatting scans | Yes (100+ signatures) | No | No |
| Interactive post-push Auto-Fix PRs | Yes (Applies diff) | Yes (Updates version) | No |
| Average setup runtime | < 30 seconds | 3 minutes | 15+ minutes config |
Rules are written from real attack patterns — not theoretical threats. Every rule maps to a documented malware campaign or CVE-class vulnerability.
Detects curl|bash and wget|sh patterns — the most common malware delivery mechanism in compromised repos.
Catches bash -i >& /dev/tcp and netcat reverse shell patterns before they reach your default branch.
Identifies base64-encoded eval() chains and obfuscated string array patterns used to hide malicious intent.
exec(compile()) and dynamic __import__() calls — the standard toolkit for PyPI malware campaigns.
Flags pull_request_target with PR head checkout — a well-known GitHub Actions vector for fork-based RCE.
Detects xmrig, stratum+tcp, and cryptonight keywords injected into CI pipelines and scripts.
Catches environment variable reads combined with outbound HTTP calls — the pattern behind most token theft.
Scans package.json and requirements.txt against 100+ known typosquatted npm and PyPI package names.
Immediately flags .env, .env.production, and .env.local being pushed to any branch.
Detects package.json postinstall scripts that make network calls — a supply chain attack staging ground.
Detects attempts to hijack internal package scopes with public npm registry uploads.
Flags dynamic inputs (like github.event.issue.title) directly interpolated in run: steps.
Everything you need to know about setting up RepoGuard.
Takes 30 seconds to install. Works on every repo, every push, immediately.
Install RepoGuard Free →