is-malicious

# is-malicious?

Scan a codebase for hidden, deceptive, or data-stealing behavior with TypeSafe Jev. The CLI sends source, configuration, build, and CI files to Jev for review, then points you to suspicious files and lines.

Use it as a second opinion before running unfamiliar code. A clean report is not proof that a project is safe.

## Quick start

You need Node.js 20 or later and a TypeSafe API key.

```bash
export TYPESAFE_API_KEY=your-api-key
npx is-malicious /path/to/project
```

Omit the path to scan the current directory. Scans send file contents to the TypeSafe API and use paid input tokens. The report includes token usage and a calculated input cost.

To install the CLI globally:

```bash
npm install -g is-malicious
is-malicious /path/to/project
```

## Reading the report

<img width="1106" height="341" alt="Screenshot 2026-09-18 at 19 35 35" src="https://github.com/user-attachments/assets/611c979a-8dd4-4fc8-8963-0843314e6a55" />

Findings include a file, line range, category, probability, confidence, and a short reason label. Use these to decide which code to read first.

Telemetry appears separately as `info`, including documented analytics, crash reports, and feature-flag pings. Telemetry alone does not cause a failing exit code.

| Exit code | Meaning |
| --- | --- |
| `0` | No high-severity findings. The report may still contain other findings. |
| `1` | At least one high-severity finding. |
| `2` | The command failed, for example because of an invalid flag or a scan error. |

If any chunk cannot be scanned, the report lists it as skipped and the command exits with code `2`.

Both high and low scores can be wrong. Review the flagged code and the scan's coverage before deciding whether to run a project.

## What it checks

Jev reviews file contents for beh