Jev in production › Code and security review
is-malicious (luantak)
CLI that sends a codebase's source, config, build and CI files to Jev and reports files and lines with probable data theft, hidden network activity or backdoors, exiting nonzero on high-severity findings.
- Use
- Code and security review
- Industry
- Security
- Form
- Open-source tool
- Stage
- In production
- Listed
- 2026-09-20
- Found via
- github
- Repository
- luantak/is-malicious
- Stars
- 37
- Forks
- 4
- Last push
- 2026-09-23
- Language
- TypeScript
- License
- MIT
The README opens with
Scan a codebase for hidden, deceptive, or data-stealing behavior with TypeSafe Jev. The CLI sends source, configuration, build, and CI files to Jev for review, then points you to suspicious files and lines.
Use it as a second opinion before running unfamiliar code. A clean report is not proof that a project is safe.
Omit the path to scan the current directory. Scans send file contents to the TypeSafe API and use paid input tokens. The report includes token usage and a calculated input cost.
Badge
For the project's own README, linking back here:
Also used for code and security review
- fingers (chainreactors) 1-2
- jgrep 92%
- JevGate $0.050
- Jevscan 56/60
- eslint-plugin-jev (ShahriarBijoy) ~100 ms
- jev-attack-surface-analysis about one cent per repo scanned
- JeVerifier 19-20 of 20
- prompt-fossils 460 of 617