See the shards attackers hide across files.

Open-source scanner for multi-file obfuscation, encoding chains, and invisible unicode tricks — across twelve languages. Runs on your machine. No account.

pipx install shardguard
Install options

Thirty seconds to a report

Install once. Scan a path or public GitHub URL. Open the offline triage HTML.

$

What we catch

Techniques that plain string-match scanners often miss until the payload is assembled.

Unicode / zero-width

e​xec('os.system(...)')
# U+200B inside the sink token

Encoding chains

eval(base64_decode(...))
# unfold depth ≤ 3, then re-scan

Multi-file shards

a.js → b.js → lifecycle
# cross-file taint to exec sink

Offline triage report

Single-file HTML with filters, keyboard navigation, Print/PDF, and ZIP download of JSON + SARIF. No login.

ShardGuard · SECURITY_REPORT.html
Files
• main.py · P0
• install.js · P1
Findings
urns/encoding-chain-unfold
Sink after base64 unfold

Evidence path
1. main.py
2. unfold:b64:depth1

Install

Isolated CLI via pipx (recommended), or pip, or from git.

pipx

pipx install shardguard
shardguard scan .

pip

pip install shardguard
shardguard scan . --open

From git

pipx install git+https://github.com/abdullahhanif-001/shardguard.git

CI

Drop into GitHub Actions; upload SARIF as an artifact.

- uses: actions/checkout@v4
- uses: actions/setup-python@v5
  with: { python-version: '3.12' }
- run: pip install shardguard
- run: shardguard scan . --depth universal --report-dir out --skip-verify
- uses: actions/upload-artifact@v4
  with: { name: shardguard-sarif, path: out/findings.sarif }

Honest gaps

Static analysis cannot prove the absence of all bugs. VM-based JavaScript obfuscators without dynamic execution, fully dynamic import(expr), and authorization logic flaws are out of scope or undecidable. See docs/RICE_BOUNDS.md.