167  guarddog(1) - Kailash Tool Reference

167.1 guarddog

guarddog - Guarddog — DataDog’s scanner: identifies malicious/typosquatted PyPI and npm packages (malicious-code + secrets rules).

Layer ATTACK
Category a-04-model-supply-chain
Safety class safe
Licence Apache-2.0
Upstream github.com/DataDog/guarddog

167.1.1 NAME

guarddog - Guarddog — DataDog’s scanner: identifies malicious/typosquatted PyPI and npm packages (malicious-code + secrets rules).

167.1.2 SYNOPSIS & usage

Derived from the upstream README at generation time; verify against --help where the tool is installed.

uvx guarddog pypi scan requests
uv tool install guarddog
# or
pip install guarddog

167.1.3 DESCRIPTION (upstream)

GuardDog is a CLI tool that identifies malicious PyPI and npm packages, Go modules, Rust crates, RubyGems, GitHub actions, or VSCode extensions. It runs static analysis on package source code (through YARA rules) and analyzes package metadata to detect supply chain attacks. What makes GuardDog different: Instead of just listing suspicious patterns, GuardDog correlates findings to identify actual risks based on attack chains. A package needs both the capability to perform an action (e.g., network access) and a threat indicator (e.g., suspicious domain) in the same file to be flagged as high risk. It downloads and scans code from: * NPM: Packages hosted in [npmjs.org](https://w

167.1.4 CONFIGURATION (detected)

Config-surface markers detected in the upstream README (5 matches, e.g. checks.yml, checks.yml). A full config reference page for this tool is queued under the config-page policy — this line is the detection record, not the page.

167.1.5 SEE ALSO

ref: v0.0.6 - verified 2026-10-14