Clone it and run it

Before you start

Check both in one line

node -v && gh --version

One line

gh auth login
npx -y gitmoru

The only thing that comes down is this tool, from npm. The repository you are looking at stays where it is. If you want to know what runs, the code is right there. Read it on npm →

If you want the restore button

Putting a branch back happens in the app, never in a command. A restore cannot be taken back, so someone should be looking at the screen when it happens.

One more thing for this one

pnpm

git clone https://github.com/gitmoru/gitmoru.git
cd gitmoru
gh auth login
pnpm install
pnpm app

Once the window opens

Type an org name and hit Dig. Leave the time window on its default.

It defaults to midnight through 7am today, because the tool was built for finding out in the morning what happened overnight. If you know when, set that instead.

Where people get stuck

gh auth login
More people stall here than on the install itself. Run gh auth status first.
The access check comes back mostly empty
Deploy keys, webhooks, runners and secrets need admin on the repo. Without it the tool says so plainly. Do not read that as "there are none". Repositories going public, being forked, and people being added show up with no permissions at all.
Nothing shows up at all
If the restore is already done, a clean result is expected. Still worth one run per account, since each account sees a different slice.

There is no installer, on purpose

This tool asks for access to your repositories. An unsigned binary asking for exactly that is indistinguishable from the attack it goes looking for.

npx runs code too. The difference is that the code sits on npm where anyone can open it. Whoever runs this just got breached, and what you hand someone on that day should be source they can read.

Worth knowing up front

It is not a website: It's a window on your machine. No URL to visit, no account to sign up for.
The token is never stored: Borrowed from gh each time, and never handed to the interface.
It never executes anything: Nothing is cloned, installed or built. It only reads.
Three languages: Korean, English, Japanese. Written in each, not translated into it.

Getting your team to run it

Every account sees a different slice. One person's scan is not the whole picture, so it is worth one run each.

Paste this into your team channel

A tool for finding out what changed after repos get hit.
Please run it once from your own account.

  gh auth login
  npx -y gitmoru

The screen opens in your browser. Enter the org name, hit Dig, leave the time window at its default.
Tell us what you got, including if you got nothing.

You need: Node 22+, GitHub CLI

It never clones or runs any code. It only reads.
The token is borrowed from gh and never stored.

https://gitmoru.dev

Ask for "nothing showed up" too. If that is indistinguishable from "never ran it", the whole team ends up believing it was checked.

Hook up an agent →