RepoTrap Scanner

Check if a strange repo is a scam or attack vector before you open it

Problem

A developer shared a firsthand experience: someone on LinkedIn posed as a tech consulting client and asked him to clone a seemingly public repo and open it in Cursor or VSCode. He got suspicious, refused, and the contact vanished. This social-engineering attack relies on 'open the repo and you're owned,' and there's no simple tool to assess a stranger's repo quickly.

Solution

A local CLI or editor plugin that scans a repo before you open it for red flags: suspicious postinstall/preinstall scripts, remote execution in package.json, dangerous .vscode/tasks.json or .cursor configs, obfuscated code, and outbound domains. It never executes code—only static checks—and produces a plain-English risk report.

Users

Developers and security engineers who take freelance work, do interview coding tests, or evaluate open-source projects

MVP

One-command repo scan; detect execution risks in install scripts and editor tasks; flag obfuscation and suspicious outbound connections; output terminal report plus JSON; fully offline, no code upload

Revenue

Open-source core plus paid team rule packs and CI integration; or a one-time desktop license

Why now

AI coding assistants make 'clone and open a repo' a daily action, expanding the attack surface; this social-engineering scam was just exposed publicly, making it the right moment for a defensive tool