CloneGuard Releases Open-Source Scanner to Intercept Credential Theft in Cloned Repositories

Software developer Tharun Rajendran has released CloneGuard, an open-source command-line utility built to inspect source code repositories for credential-harvesting mechanisms and execution traps before developers build, install, or open unfamiliar projects.

The utility targets an increasingly widespread social engineering vector aimed at software engineers, where attackers masquerade as recruiters or technical collaborators sharing sample code or take-home evaluations. In these campaigns, cloning a project and running routine package installation commands or opening the directory in an editor can quietly trigger scripts that extract cloud credentials, local SSH keys, and browser data without ever running the intended application.

CloneGuard was created after the author encountered a fake recruiter's demo application designed to harvest SSH and AWS keys, according to repository documentation published on github.com at https://github.com/tharun208/cloneguard. The utility functions as an initial inspection gate to evaluate whether an unfamiliar codebase contains obvious indicators of compromise before an engineer interacts with it.

Written in Go and requiring Go 1.24 or later, CloneGuard operates with zero external dependencies and runs in a strictly read-only capacity. The tool never executes, compiles, installs dependencies for, or imports packages from the target repository. Users can analyze local directories directly or use the tool's clone sub-command, which executes a standard git clone to retrieve remote files without running project-level scripts, immediately followed by an automated scan.

The scanner evaluates code and configuration files line by line against pattern-matching rules, bypassing .git directories, package caches, and virtual environments by default, as well as files larger than a configurable two-megabyte threshold. It flags file-access patterns targeting private SSH keys, cloud provider configurations across AWS, GCP, Azure, and Kubernetes, browser credentials, cryptocurrency wallets, shell history files, and global environment variable dumps.

Beyond credential discovery, CloneGuard searches for automated execution triggers. These include npm lifecycle hooks, Python setup scripts, precompiled binaries, and `.vscode/tasks.json` configurations crafted to launch commands as soon as an editor loads the workspace. The tool also identifies code obfuscation such as hex escapes, dynamic evaluation calls like eval, and network requests bound for raw IP addresses, public tunnel services, or messaging endpoints on Discord and Telegram.

The tool outputs findings ranked across low, medium, high, and critical severity levels, accompanied by plain-language descriptions of why a specific code snippet triggered an alert. When an individual file exhibits multiple overlapping risks—such as accessing sensitive credential paths while simultaneously calling an outbound network endpoint—the scanner elevates the finding to a critical rating. CloneGuard provides human-readable text and JSON output formats, returning distinct non-zero exit codes to support automated enforcement in local Git hooks or continuous integration workflows.

The project documentation notes that passing a scan does not serve as a definitive guarantee of safety, cautioning that signature-based regex heuristics cannot catch novel evasion techniques and may occasionally flag legitimate tools such as password managers. The repository advises developers to continue handling untrusted source code inside isolated virtual machines or ephemeral containers.