> For the complete documentation index, see [llms.txt](https://docs.elliott.diy/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.elliott.diy/code-scanning/github-repo-scanner.md).

# GitHub Repo Scanner

This endpoint scans a specified GitHub repository for potentially malicious code. It identifies risky executions, known encrypted payloads, obfuscated scripts and common malware patterns. 

The API provides detailed detections with file names, line numbers, and decoded content (if applicable).

{% hint style="warning" %}
This API is for non-commercial use. If you would like to use it in a commercial product or in a way that generates revenue, please contact me at **<hey@elliott.diy>**. The service is not designed to scale for commercial demands, and I want to maintain a high quality of service for existing users.
{% endhint %}

***

### **Endpoint**

```http
https://api.elliott.diy/v1/malware/github?repo=<GitHub_Repo_Owner>/<Repo_Name>
```

***

### **Request Parameters**

| Parameter | Type   | Required | Description                                                   |
| --------- | ------ | -------- | ------------------------------------------------------------- |
| `repo`    | string | ✅ Yes    | The GitHub repository to scan, formatted as `<owner>/<repo>`. |

***

### **Example Request**

```bash
curl "https://api.elliott.diy/v1/malware/github?repo=grobarqxd6996/Discord-Boost-Tool"
```

***

### **Response Format**

* **Content-Type:** `application/json`
* **Status Codes:**
  * `200 OK`: Successfully analyzed the repository.
  * `400 Bad Request`: Invalid or missing repository name.
  * `500 Internal Server Error`: An error occurred during analysis.

**Example Response (Defanged)**&#x20;

```json
{
  "detections": [
    {
      "file": "muck-stealer.py",
      "line": 22,
      "content": "import subprocess; subprocess.run(['pip', 'install', 'cryptography'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL); ...",
      "decoded": null
    }
  ],
  "urls": null,
  "suspicious": true
}
```

***

### **Response Fields**

| Field        | Type           | Description                                                           |
| ------------ | -------------- | --------------------------------------------------------------------- |
| `detections` | Array          | List of detected suspicious code patterns.                            |
| `file`       | String         | Name of the file where the detection occurred.                        |
| `line`       | Integer        | Line number where the suspicious content was found.                   |
| `content`    | String         | Snippet of the detected code.                                         |
| `decoded`    | String or null | Decoded content if applicable.                                        |
| `urls`       | Array or null  | Extracted URLs (if any).                                              |
| `suspicious` | Boolean        | Indicates whether the repository contains potentially malicious code. |

***

### **Usage Notes**

* The API **flags suspicious patterns** but does not guarantee accuracy—manual review is recommended.
* If `decoded` is `null`, the script may contain **encrypted or obfuscated** code that requires further analysis.
* If the payload is heavily obfuscated the API may fail due to internal database constraints.&#x20;
* Designed to help detect **malware, info stealers, and automated threats** in repositories.