snare
claudeFinds supply-chain droppers committed directly into a repository — the kind npm audit cannot see because there is no malicious dependency. Scans a clone or every repo you can reach, removes the payload including from history, and helps warn collaborators.
1 skill · hooks
11