is-malicious

# is-malicious?

Scan a codebase for hidden, deceptive, or data-stealing behavior with TypeSafe Jev. The CLI sends source, configuration, build, and CI files to Jev for review, then points you to suspicious files and lines.

Use it as a second opinion before running unfamiliar code. A clean report is not proof that a project is safe.

## Quick start

You need Node.js 20 or later and a TypeSafe API key.

```bash
export TYPESAFE_API_KEY=your-api-key
npx is-malicious /path/to/project
```

Omit the path to scan the current directory. Scans send file contents to the TypeSafe API and use paid input tokens. The report includes token usage and a calculated input cost.

To use another service that implements the [TypeSafe evaluation API](https://docs.typesafe.ai/api), set its API root and key, then choose a model it serves:

```bash
export TYPESAFE_API_KEY=your-provider-key
is-malicious /path/to/project --base-url http://localhost:8000 --model your-model
```

The API root can also come from `TYPESAFE_BASE_URL`; `--base-url` takes precedence. The service must accept `POST /v1/systemone` with TypeSafe's `state`, `model`, and typed `questions` request and return matching `answers` and `usage`. The CLI reports token counts for other providers but leaves cost unknown because their prices vary. File contents go to the configured endpoint. Model quality and scan accuracy depend on the provider.

To install the CLI globally:

```bash
npm install -g is-malicious
is-malicious /path/to/project
```

## Reading the report

<img width="1106" height="341" alt="Screenshot 2026-09-18 at 19 35 35" src="https://github.com/user-attachments/assets/611c979a-8dd4-4fc8-8963-0843314e6a55" />

Findings include a file, line range, category, probability, confidence, and a short reason label. Use these to d