Overview & result
The author built is-malicious, a codebase scanner that asks whether code is obviously malicious, points to suspicious parts of files, and can serve as a first line of defense for pull requests or a coding-agent skill.
From the original post
I played around with jev from typesafe a little today, and thought this is a pretty good application of it.
is-malicious scans an entire codebase for hidden, deceptive, or data-stealing behavior, and points you directly at the suspicious parts of files if it finds any.
It can also be used as a first line defense on pull requests on your own repos, or integrated into your coding agent via the skill.
How Jev fits in the loop
- Scan the codebase for hidden, deceptive or data-stealing behavior.
- Use Jev for the bounded malicious/not-malicious judgment.
- Point the developer or coding agent to suspicious file locations for review.
How to reproduce
- Clone https://github.com/luantak/is-malicious and follow its README.
- Scan a codebase and inspect the suspicious file locations returned by the tool.
- Try it as a pull-request check or coding-agent skill, keeping false positives and false negatives under review.
Why this build matters
A concrete security screening use case for Jev inside developer workflows, with the quality limits left visible.
Limitations
- The source post reports no false-positive or false-negative measurements.
- The author describes the tool as an application of Jev, not a security guarantee.