is-malicious

What it is

Scan a codebase for hidden, deceptive, or data-stealing behavior with TypeSafe Jev. The CLI sends source, configuration, build, and CI files to Jev for review, then points you to suspicious files and lines.

Getting started

From the README:

export TYPESAFE_API_KEY=your-api-key
npx is-malicious /path/to/project

Where the decision sits

is-malicious calls the hosted decision API rather than running its own weights. That keeps the project small and means its behaviour moves whenever the vendor ships a new model version. It also means an API key and a network round trip sit in the path of every decision.

Models it references: Jev.

How active it is

Created 2026-09-18, last pushed 2026-09-23, 39 stars and 5 forks when we read it on 2026-11-02. Everything in this category is weeks old at most, so a stale push date means something different here than it would on a mature project. Check the repository before you depend on it.