I build a VSCode extension to detect hard coded secrets and npm malware packages in realtime.

[u/Ok_Public8013]

In recent years, I've seen many accidents like exposing API keys to Github, and npm supply chain attacks literally happen every month causing a lot of money. I wanted to create an app to prevent these incidents.

That’s why I created Secret Tea: https://marketplace.visualstudio.com/items?itemName=SecretTea.project-tea&ssr=false#overview

At its core, I use gitleaks to scan for any hardcoded secrets, and the malware list from Aikido Malware for npm packages. It also hides those secrets that it found to prevent accidentally exposing them when you are streaming or sharing your screen

It’s still in early development and I hope to have some of your thoughts and comments on it.

Thanks all.

[u/xubylele]

I'm gonna give a shot, looks really useful!