openyard-cloud/vetcode-demo-malware
What the code can do, signs of malware, and tricks in install scripts. Read, never run.
Code check
Read by vetcode without running anything, at the commit below. Check again any time.
ca9f6d0- Malware and stealers
- Install scripts and hooks
- Hidden or encoded code
- CI and AI agent setup
What the code can do
- Reads secrets or environment variables1 file
- Connects to the internetNew1 file
- Starts other programs1 file
- Reads user and machine details1 file
- Builds or decodes code while running1 file
New since the previous check. Updates that suddenly gain abilities are how hijacked packages show up, so it is worth a look.
Findings to look at4
critical
[](https://openyard.cloud/check/openyard-cloud/vetcode-demo-malware)
Patterns, not proof: a finding is a reason to read the code, not a verdict on the maker. Vulnerability candidates and leaked-secret locations are not published here.
Go deeper with your AI agent
The check above is the scanner on its own. Your agent, with the vetcode skill, reads the code around each finding, throws out false alarms and looks for what rules cannot see, such as missing permission checks or broken logic.
claude plugin marketplace add openyard-cloud/vetcode && claude plugin install vetcode@openyardInstalls vetcode as a plugin, once per machine.
Use the vetcode skill to review https://github.com/openyard-cloud/vetcode-demo-malware before I install it. Download it into a temporary folder and do not run, install or build anything from it. Read the code around every finding to confirm or rule it out, then look for what patterns cannot catch. OpenYard's scanner flagged it: explain each finding and whether it is malicious. Finish with a plain answer: safe to install, or not, and why.
npx skills add openyard-cloud/vetcodeAdds the vetcode skill where Codex looks for skills.
Use the vetcode skill to review https://github.com/openyard-cloud/vetcode-demo-malware before I install it. Download it into a temporary folder and do not run, install or build anything from it. Read the code around every finding to confirm or rule it out, then look for what patterns cannot catch. OpenYard's scanner flagged it: explain each finding and whether it is malicious. Finish with a plain answer: safe to install, or not, and why.
npx skills add openyard-cloud/vetcodeThe skills CLI knows where each agent keeps its skills.
Use the vetcode skill to review https://github.com/openyard-cloud/vetcode-demo-malware before I install it. Download it into a temporary folder and do not run, install or build anything from it. Read the code around every finding to confirm or rule it out, then look for what patterns cannot catch. OpenYard's scanner flagged it: explain each finding and whether it is malicious. Finish with a plain answer: safe to install, or not, and why.