Lintel AI/Scan
Scan: check a project before you trust it.
Found something on GitHub and not sure it is clean? Point Scan at its folder. It looks for install scripts, hidden downloaders, credential stealers and obfuscated code, and tells you what it found and on which line. Nothing is run, and nothing leaves your computer.
Why it exists
A downloaded project can run code before you have read a line of it.
Install scripts run on npm install. A setup.py can override the install step. Build events run when a solution compiles. A VS Code task can be set to run the moment a folder is opened. Most projects use none of this maliciously, which is exactly why the few that do get away with it.
Scan exists to answer one question before any of that happens: does anything here deserve a closer look? It reads the project as text and bytes, so it is safe to point at something you do not trust.
package.json
148 files checked · 3 files with findings
"postinstall" runs automatically on npm install and calls out to the network or a shell.
How to use it
- Download it, do not open it. Do not run, build or open the folder in an editor first. Some projects run code the moment you do. Download or clone it and leave it alone.
- Switch to Scan with the control at the top of the sidebar, and choose the project's folder.
- Pick a level. Normal needs nothing else. Advanced also needs an Ollama model.
- Press F5. You get a verdict and the exact lines behind it.
What it reads
Scan collects files differently from Lint, because the places malware hides are the places a code review ignores.
- Everything, including binaries
- Binary files, hidden files and unusual extensions are all included. The first 4 KB of each file is inspected to recognise Windows (PE), Linux (ELF) and macOS (Mach-O) executables whatever they are called.
.AIIgnoreis ignored- The project being checked does not get to decide what is left unchecked.
- Links are never followed
- A symbolic link or junction in a downloaded project can point anywhere on your machine. They are listed as skipped, not read.
- Skipped folders
.git,node_modules,__pycache__,.venvandvenvonly. A notice under the verdict names what was not inspected, and how many binary files cannot be read as code, so a quiet result is not mistaken for full coverage.- Size limits
- Up to 5,000 files per scan, and text files up to 10 MB. A larger text file is reported as not scanned rather than silently passed.
- Never executed
- Files are read, never run, built, installed or loaded.
What it detects
Four families of rules run on every file. Each finding carries a severity, a name, the line, and a sentence explaining why it matters.
1. File name and file type
What a file is called, and what it really is, without reading its content.
- Executable disguised as another type. A file named like an image or document whose header says it is a program.
- Double extensions.
invoice.pdf.exeand similar. - Right-to-left override. A hidden character in the file name that flips how it is displayed.
- Compiled binaries shipped with source, which cannot be reviewed as code.
- Windows script and shortcut files:
.vbs,.vbe,.jse,.wsf,.wsh,.hta,.lnk,.cpl,.reg.
2. Files that run without being asked
These are the usual way a downloaded project infects whoever merely opens it.
package.json:preinstall,install,postinstallandpreparescripts. A script that reaches the network or a shell is high; any other is medium. Routine steps such ashusky installortscare not reported.setup.py: an overridden install command that also runs system commands or network calls..vscode/tasks.json: a task set to run when the folder is opened.- MSBuild files (
.csproj,.vbproj,.fsproj,.targets,.props):Exectasks and pre/post-build events, high when they call a shell or the network.
3. Known malicious patterns
Twenty-two line-level patterns, listed in full in the catalogue below: download and execute, encoded PowerShell, credential and wallet theft, persistence, process injection, reverse shells, miners, tampering with security software, and others. Comment lines and documentation files are skipped, and each pattern is reported at most five times per file so one noisy file does not bury the rest.
4. Obfuscation
Signs that code was made hard to read on purpose, which honest projects rarely do.
- Invisible Unicode characters that reorder text so the code reads differently from how it runs (the "Trojan Source" technique).
- Base64-looking strings of 300 characters or more, long runs of
\xescapes, and strings built from character codes. - Ten or more lines using
_0x-style names, the signature of javascript-obfuscator. - A single line longer than 4,000 characters in a file type that is not data.
Formats that are long and encoded by nature, such as .json, .svg, .css, .map and minified files, are not flagged for line length, and embedded data URIs for images and fonts are not flagged as blobs.
The verdict
Scan does not produce a quality score, because a number out of 100 would read as "fine" for a file that is not. It produces one of three verdicts, decided by the most serious alert found.
| Verdict | When | What the app tells you |
|---|---|---|
| Dangerous | At least one high-severity alert. | Patterns commonly used by malware were found. Do not run, build or open this project in an editor. |
| Suspicious | No high alert, at least one medium. | Some files do things that deserve a closer look before you run or build anything. |
| No findings | Nothing above low severity. | No known malicious patterns matched. That is not a guarantee the project is safe. |
Below the verdict, the files with findings are listed with their alerts, severities and lines, plus the number of files checked and anything that was skipped.
A clean result is not a certificate. A careful attacker can avoid known patterns, and a pattern check cannot understand intent. Use Scan to catch the common and the careless, not to vouch for a project.
Normal and Advanced
| Normal | Advanced | |
|---|---|---|
| Method | Rules and patterns only | The same rules, then a local model reviews what they found |
| Needs a model | No | Yes, through Ollama |
| Needs the network | No | Only to your Ollama address |
| Speed | Fast: no model is involved | Slower: depends on the depth you choose and your hardware |
| Can reduce false alarms | No | Yes, medium alerts only |
| Can find what the rules missed | No | Yes, in a limited number of files, with checks |
Both levels start the same way. Advanced never replaces the rules; it reviews their output. If the model is unavailable, the rule results stand.
How the model is used
A small model asked to "find the problems in this file" will invent some. So Advanced does not ask that. It asks narrow questions, requires evidence, and limits what the answers are allowed to change.
Stage 1: judging the alerts
- Only medium alerts are put to the model, up to 60 per scan, and only in files that have no high alert.
- Each alert is judged with a question specific to its rule, with a description of what harmless and harmful look like for that rule, and about 25 lines of code around the flagged line.
- The model must answer with a verdict (benign, malicious or unclear), a reason, and a quote copied from the code. A quote that is not in the code it was shown makes the answer count as "unclear".
- To clear an alert, two differently framed checks must both say benign with valid quotes. One says benign and the other does not: the alert stays as the rules found it, with a note.
- A cleared alert is lowered to low, with the model's reason and quote written into the description so you can disagree with it.
- A confirmed alert keeps its severity and gains the model's reasoning, labelled as an opinion that can be wrong.
Stage 2: looking for what the rules missed
- Balanced and Thorough only. The model reads files most worth a second look: those already flagged without a high alert, and install and shell scripts. Documentation files are not read.
- It may propose up to five findings per piece of file, each in one of nine categories: downloads and runs code, sends data out, reads credentials, persistence, hidden payload, process injection, destructive action, remote shell, disables security.
- A proposal is accepted only if its quote exists in the file, the line is not a comment, the rules did not already report that line, and two differently framed checks both call it harmful with valid quotes.
- Accepted proposals are added as medium and labelled "AI-suggested". They never exceed medium.
What the model can never do
- Raise severity
- It can lower a medium alert or confirm it. It cannot make anything worse than the rules said.
- Clear a high alert
- High alerts are not shown to the model at all. Small models were measured calling real malware harmless, which is the worst failure a security scan can have.
- Clear certain alerts
- Hidden Unicode controls, right-to-left file names, double extensions, compiled binaries, Windows script files, reverse shells, crypto miners, destructive commands, tampering with security software, and executables disguised as other types are never put up for clearing.
- Make a project Dangerous alone
- Because its own findings are capped at medium, only the rules can produce a Dangerous verdict.
- Fail silently
- After three consecutive model failures the AI stages stop, the rule results are kept, and the notice under the verdict says it stopped early and why.
Depth
Every depth has the same safeguards. A deeper level gives the model more to read, so it takes longer and can find more.
| Depth | What the model reads | Use when |
|---|---|---|
| Quick | Judges the medium alerts the rules raised. Reads nothing else. | You want fewer false alarms, fast. |
| Balanced | Quick, then reads the start of up to 8 risky files, looking for what the rules missed. | The default. A reasonable second look. |
| Thorough | Quick, then reads up to 25 risky files, up to three pieces each. Can take a long time. | A project you particularly want to examine, on a capable machine. |
Pattern catalogue
The line-level patterns the rules look for, with the severity each carries. A match is evidence, not a conviction: legitimate software does some of these things, which is why Advanced exists.
| Pattern | Severity | What it looks for |
|---|---|---|
| Download and execute | High | Fetching code from the internet and running it straight away, such as curl … | sh or iex on a download. |
| Living-off-the-land download | High | Built-in Windows tools used to download or run remote code: certutil, bitsadmin, mshta, regsvr32. |
| Encoded PowerShell command | High | A command hidden inside an encoded string passed to PowerShell. |
| Decode then execute | High | Decoding or decompressing a payload and executing it. |
| Discord / Telegram exfiltration | High | Webhook or bot endpoints, the usual way stolen data leaves a machine. |
| Browser data theft | High | Browser profile files where saved passwords and cookies live. |
| Wallet or session theft | High | Crypto wallet files and Discord session storage. |
| Process injection | High | Writing code into another running process. |
| Security software tampering | High | Disabling antivirus, deleting backups or logs, changing the firewall. |
| Reverse shell | High | Giving a remote machine an interactive shell on this one. |
| Crypto miner | High | Mining pools and well-known miner software. |
| Destructive command | High | Wiping disks or deleting everything under a root folder. |
| Hidden PowerShell window | Medium | PowerShell started with its window hidden. |
| Anonymous drop or tunnel | Medium | Throwaway endpoints, file drops and tunnel services. |
| Discord-token-like string | Medium | A string shaped like a Discord account token. |
| Credential file access | Medium | SSH keys, cloud credentials, Kubernetes config, stored git or Docker credentials. |
| Keylogging or screen capture | Medium | Global keyboard hooks, screenshot and key-listener APIs. |
| Persistence | Medium | Registry run keys, scheduled tasks, startup folders, launchd. |
| In-memory assembly loading | Medium | Loading a .NET assembly from decoded or downloaded bytes. |
| Key state polling | Low | Reading key state by variable, as a loop over every key would. Normal for games. |
| Hard-coded IP address | Low | A public IP address instead of a domain. Local and private ranges are ignored. |
| Dynamic code evaluation | Low | eval and new Function. Often harmless, but how hidden payloads are run. |
Limits
- It is a pattern check. It finds what it has been told to look for. Novel or carefully written malware can pass.
- Dependencies are not inspected.
node_modulesand virtual environments are skipped, so a malicious package that is already installed is out of scope. What Scan can see is the manifest that would install it. - Compiled code is not analysed. A binary is recognised and flagged, not reverse-engineered.
- The model is an assistant. It can be wrong in both directions, which is why it is limited the way it is.
- Large projects are truncated. Beyond 5,000 files the scan stops and says so.
- Not a sandbox. Scan never runs the project. If you need to know what it does when executed, use an isolated machine.
FAQ
Does Scan run the project it checks?
No. Scan only reads files. It never runs, builds, installs or opens anything from the project, and it does not follow symbolic links.
What is the difference between Normal and Advanced?
Normal uses rules and patterns only, works offline and needs no model. Advanced runs the same rules, then has a local Ollama model judge what they found. The model can clear false alarms and add checked findings but can never clear a high-severity alert.
Can a clean result be trusted?
A clean result means no known malicious patterns matched. It is not a guarantee: a careful attacker can avoid known patterns.
Why does Scan ignore .AIIgnore?
The project being checked must not get to decide what is left unchecked. A malicious project could otherwise hide its payload behind an ignore rule.
My own project came back Suspicious. What now?
Open the findings and read the lines. Install scripts and build steps are flagged because they run automatically, not because they are wrong. If you wrote them, a Suspicious result is a prompt to confirm they do only what you intend.
Does Advanced send my files anywhere?
Only to the Ollama address in Settings, which is your own computer by default. The sidebar warns you if it points to another machine.
Continue
Check it before you run it.
Free, open source, Windows. Nothing leaves your computer.