What RepoCanary catches

BeaverTail postinstall pipes a download into a shell

preinstall runs base64-decoded code with node -e

postinstall runs a local file that fetches and runs code

postinstall hands a download to bash by process substitution, no pipe to match

prepare script (runs on git install) fetches and evals

a plain npm script the README asks you to run pipes a download into a shell

gypfile: true compiles and runs a native build during npm install

a frontend app that also pulls in server and raw network packages

Python setup.py shells out at install time

Rust build.rs reaches for the network at compile time

Gradle build runs an external command

Maven exec plugin downloads and runs during build

requirements.txt installs from a URL, not PyPI

PHP composer post-install script downloads and runs code

Yarn Berry yarnPath points at a checked-in program, not the release bundle

a Jupyter notebook code cell downloads and executes a payload

Ruby native-extension build (extconf.rb) shells out at gem install time

a go:generate directive that downloads and runs a script

Gradle pulls dependencies from a plain-http repository

Maven pulls dependencies from a plain-http repository

requirements.txt redirects pip to a private index

a Kotlin DSL Gradle build hands a download to a shell; commandLine("x") is the Kotlin spelling of commandLine 'x'

Yarn 1's .yarnrc points yarn-path at a checked-in program, the same hijack as Berry's yarnPath

lockfile resolves a familiar name to an attacker tarball

npm alias protocol installs a different package under a trusted name

a scope one edit from @types

depends on a package confirmed malicious in these campaigns

one-edit lookalike of a popular package, in a repository from a fresh account

manifest asks for a version range, the lockfile resolves it from a git repository

a dependency installed from a git source, not the registry

a deep dependency declares an install script

committed .npmrc points npm at an attacker registry

a committed .npmrc carries an auth token

an npm override sends a trusted name to a tarball URL

a committed .npmrc pointing npm at an unknown https registry with nothing else beside it; a company mirror and a hijack look the same, so it is a caution to read

obfuscated eval(atob()) hidden in a build config

new Function('require', fetchedCode) staged loader

child_process assembled from string pieces to dodge scanners

a zero-width character splits an identifier

Unicode Private Use Area characters hide a payload as blank space

bidirectional override characters make the source read differently than it runs

a lookalike domain using a Cyrillic letter

a large base64 blob beside the code that decodes it

a loader parked after hundreds of spaces on a line that looks like a comment

a source file that is mostly hex data

the self-rotating string table of an automated JavaScript obfuscator

text carried in Unicode tag characters, a block that renders as nothing at all

reads browser credential stores and a wallet extension by id

reads SSH keys and cloud credential files

reads the environment and posts it out

walks the filesystem hunting for wallet and seed files

pulls in keylogging and screen-capture components

osascript pops a fake system password dialog to phish the login password

a keylogger and a screen-capture module wired into an app

bare IP on a Contagious Interview C2 port

calls documented BeaverTail command-and-control paths

InvisibleFerret remote-command handlers

fetches its next server address from a Google Doc dead drop

posts collected data to a Discord webhook

opens a tunnel to reach the victim without a fixed server

uploads collected data to an anonymous file host

silently installs a remote-desktop tool for unattended access

spawns PowerShell with a base64-encoded command to hide the payload

uses certutil, a trusted Windows binary, to download the payload

a disposable free-hosting endpoint on a campaign-style path

VS Code task runs a command the moment the folder opens

dev container hook downloads and runs code on open

the same dev container hook behind a comment and a trailing comma; devcontainer.json is JSONC, so the tooling runs it either way

a dev container configuration that cannot be parsed at all, so what it starts is unknown

Makefile target pipes a download into a shell

pull_request_target runs untrusted code with secrets

workflow curls repository secrets out

Dockerfile pipes a download into a shell during build

Dockerfile saves a script on one line and runs it on a later one

Makefile target evaluates a download as command text

.pnpmfile.cjs runs code during pnpm install

VS Code settings point a linter at a checked-in binary run on folder open

.envrc runs on cd into the directory and downloads code

docker compose service pipes a download into a shell

a dev container initializeCommand runs on the host, outside the container

Dockerfile bakes a file straight from a URL into the image

a make target decodes base64 into a command

workspace settings inject environment variables into every terminal

a workflow that targets a self-hosted runner the candidate is asked to register

a checked-in MCP server the AI editor starts when the folder is opened

an agent hook runs a downloaded script while the coding agent works

a .code-workspace file carries the tool-path hijack outside .vscode/

a dir-local eval form runs when a file in the directory is opened

a project-local Neovim config spawns a process when the folder is opened

an instruction hidden in an HTML comment, aimed at the coding agent and invisible to the reader

an instruction file that displaces the agent's own instructions and tells it to hide what it does

instructions painted out of sight, so the rendered file and the file the agent reads differ

a forged system turn inside the file an agent reads as instructions

a markdown image whose address carries a secret, so rendering it is the exfiltration

a folder-open task whose args name a checked-in program by a bare relative path, with the interpreter in command and the file in args

installs an executable that shadows the real npm command

installs itself into a shell startup file to survive reboot

checks for a VM before activating (OtterCookie behavior)

brand-new account, crypto theme, install-first README

README tells the victim to paste a shell command to fix a fake error

a company organization with no public members