47,133 repositories indexed
1–22 of 22 · Most stars
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
Malicious traffic detection system
Investigate malicious Windows logon by visualizing and analyzing Windows event log
Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.
A utility to safely generate malicious network traffic patterns and evaluate controls.
Protect against malicious open source packages 🤖
Malicious HTTP traffic explorer
A "malicious" DNS server for executing DNS Rebinding attacks on the fly (public instance running on rebind.network:53)
PEframe is a open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.
Local gateway for Claude Code, Codex and other AI clients on macOS, Windows and Linux: switch upstreams without touching clients, keep API keys from relays, cut off malicious tool calls, trace every request.
Yet another static code analyzer for malicious Android applications
teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.
A modular Python application to collect intelligence for malicious hosts.
:vertical_traffic_light: Block malicious crawlers with Cloudflare Firewall Rules
A modular Python application to pull intelligence about malicious files
The current repository contains all the scripts needed to build kernel-mode mac-a-mal malicious activity hooking on macOS.
YALIH (Yet Another Low Interaction Honeyclient) is a low Interaction Client honeypot designed to detect malicious websites through signature, anomaly and pattern matching techniques
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
Detect the Shai Hulud 2.0 npm supply chain attack (796+ packages). Scans for malicious files, hashes, and compromised ecosystems. Fast, accurate scanner.
Deep network visibility, powered by Suricata. Artica integrates the Suricata IDS engine directly inside your server, giving you enterprise-grade intrusion detection without the complexity. Monitor every packet in real time, detect advanced threats, and visualize malicious
A simple tool to organise large malicious/benign files into a organised Structure.