Static Code Analysis
Score a package coordinate for malware indicators
A package coordinate in, indicator hits out.
overview
What guarddog does
GuardDog scores one package coordinate at a time for malware indicators. Install scripts, typosquat names, and similar signals become rows in the findings file.
A Managed-fleet smoke on one npm coordinate printed scanned 1, 0 risk findings. An empty findings file means that coordinate produced no indicator hit.
Use malcontent when you want behavior rules instead of indicator hits. Use OSV Malicious when you want a published MAL id.
source github.com/DataDog/guarddog
use cases
Where guarddog fits
Catch an install-script signal
Feed a coordinate and read whether GuardDog kept an indicator hit.
Accept a quiet coordinate
Zero risk findings means GuardDog kept no indicator for that name and version.
Separate indicators from advisories
Keep this node for indicator hits. OSV Malicious is the lookup that returns a MAL id.
reference
guarddog inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| input | FOLDER | --input | Folder of package coordinate JSONL files. |
Showing key inputs. guarddog exposes 1 inputs in total.
example
Run guarddog
guarddog --input ./packagesguarddog: scanned 1, 0 risk findings across 0 packagesguidance
Choosing guarddog
Use GuardDog for malware-indicator hits such as install scripts and typosquats. Use malcontent for behavior rules, and OSV Malicious for a published MAL id.
osv-malicious
Returns published malware advisory ids for a coordinate.
malcontent-scan
Reports risky behavior on a package coordinate.
osv-scanner
Matches lockfiles to vulnerability advisories.
faq
guarddog questions
related
More Static Code Analysis tools
bandit
Python source in, JSON security findings out.
gitleaks
Detect hardcoded secrets in git repos and plain directories.
gosec
Go AST security scanner for credentials, crypto, and injection.
malcontent-scan
A package coordinate in, behavior findings out.
osv-malicious
A package coordinate in, malware advisory rows out.
osv-scanner
A lockfile in, advisory rows out.
Run guarddog yourself
One npm coordinate produced no GuardDog indicator hit, so the findings file was empty.
Facts on this page come from the live Trickest tool library.