Install

Pick your machine

Free and open source under the MIT licence. Requires bash, git, python3 and the GitHub CLI. About a minute end to end.

macOS · Homebrew

brew install git gh python3 git-filter-repo

git clone https://github.com/nexlabz/snare ~/snare
cd ~/snare && ./install.sh
gh auth login
snare doctor

The guard runs as a launchd user agent, started automatically at login.

Linux

# Debian / Ubuntu
sudo apt install -y git python3
# gh: github.com/cli/cli/blob/trunk/docs/install_linux.md
#
# Fedora:  sudo dnf install -y git python3 gh
# Arch:    sudo pacman -S git python github-cli

git clone https://github.com/nexlabz/snare ~/snare
cd ~/snare && ./install.sh
gh auth login
snare doctor

The guard runs as a systemd --user unit. No systemd? Run snare guard run --interval 1 yourself under your own supervisor.

Windows · Git Bash

winget install Git.Git GitHub.cli Python.Python.3.12

# then, from Git Bash — not cmd or PowerShell
git clone https://github.com/nexlabz/snare ~/snare
cd ~/snare && ./install.sh
gh auth login
snare doctor

snare is written in bash, so it needs Git Bash or WSL. snare guard install registers a logon Scheduled Task.

Windows Subsystem for Linux

sudo apt install -y git python3
git clone https://github.com/nexlabz/snare ~/snare
cd ~/snare && ./install.sh
gh auth login
snare doctor

The guard only sees processes inside WSL, not Windows itself. If you develop on Windows proper, run snare from Git Bash instead.

Requirement	Why it is needed
`bash` `git` `python3`	Core. Already present on macOS and most Linux distributions.
`gh`	All GitHub access uses your credentials. snare ships no token and stores none.
`git-filter-repo`	Optional — only for `snare fix --purge-history`.

After installing

The four commands that matter on day one

Four verbs. It uses your own GitHub credentials and ships no token of its own.

snare guard install

Watch this machine

Detects the loader and kills it — process and children — within about a second, then saves the evidence. It only ever kills interpreters, so a shell that merely mentions an indicator is left alone.

snare scan github

Scan every repo

Checks every repository you can reach through the API without cloning any of them. snare scan repo . goes deeper on a clone: working tree, every branch, full history.

snare fix owner/repo

Clean it out

Writes a backup bundle first, always. Cleans branch tips, or purges the payload from every commit in history. Dry run unless you explicitly say otherwise.

snare notify owner/repo

Warn your team

Files a GitHub issue mentioning your collaborators and opens a pre-filled mail draft for each one. It never sends anything — you send from your own account.

Not sure where to start?

Run snare respond. It walks you through the whole thing — check the machine, rotate credentials, find what is infected, clean it, tell your collaborators — one question at a time, in the order that actually works. Nothing is changed without you saying so, and it remembers where you got to if you stop.

Would you rather your AI assistant did this?

Paste the prompt below into Claude Code, Cursor, Copilot or any assistant that can run commands. It installs snare, checks your machine, and reports back — and it is written to stop and ask you before anything is changed.

Copy this

Please help me check my machine and my repositories for the supply-chain
malware described at https://nexlabz.github.io/snare/

1. Clone and install the scanner:
     git clone https://github.com/nexlabz/snare ~/snare
     cd ~/snare && ./install.sh
   It needs bash, git, python3 and the GitHub CLI (gh). Install whatever is
   missing for my platform first.

2. Confirm the scanner itself works before trusting any result:
     snare selftest
   If that fails, stop and tell me — a scanner whose detection is broken
   reports "clean" on infected repositories.

3. Check this machine and show me the output:
     snare doctor
     snare guard scan

4. Scan my repositories and show me exactly what was found:
     snare scan repo .        # the repo I am in: working tree, branches, history
     snare scan github        # every repo my gh account can reach

Important, please follow these:
- Do NOT run "snare fix", "--push" or "--purge-history" without asking me
  first and showing me what would change. They rewrite git history.
- If anything is found, tell me to rotate my credentials BEFORE cleaning any
  repository. Stealing credentials is what this malware is for, and cleaning
  a repo from an infected machine just lets it re-inject.
- "snare guard scan" saying "clean" does not mean I was never infected. The
  loader runs when a build runs or an editor opens the folder, then exits.
- Explain what you find in plain language, and tell me what you are unsure
  about rather than guessing.

The prompt deliberately forbids the destructive commands. If your assistant offers to run snare fix --purge-history unprompted, say no and read the walkthrough first — that rewrites every commit and breaks every existing clone.

Already had snare installed before 29 August 2026?

Run snare update and then snare selftest before you trust a clean result. Several defects in earlier versions made the scanner report clean on genuinely infected repositories — they are listed first in the changelog, because that is the failure that matters most in a scanner.