Run it here first
Find out what that command really does, before you run it.
Paste the command and what you were told it does. FirstRun runs it in a throwaway sandbox dressed up as a developer laptop, then shows what it actually touched, who it talked to, and whether that matches the story.
-
Nothing runs on your machineA fresh Linux sandbox is built for each run and destroyed after it.
-
Fake credentials, fake internetEvery key is a decoy and every host leads to a recorder. If the command steals, you see it.
-
A verdict from fixed rulesWhat was observed is compared with what you were told. No guessing.
Checking the command
How it works
A laptop that is not yours
A fresh Linux sandbox is seeded with realistic fake credentials: SSH keys, cloud keys, tokens, a wallet. Every one is a decoy made for this run.
The command runs for real
Hidden encoding is peeled off first. Then the command runs exactly as pasted, with every file access, process and connection recorded from outside.
Told against done
Fixed rules compare what happened with what you were told. A decoy leaving the sandbox is always malicious, whatever the story said.
What a result does and does not mean
- Linux commands only. The sandbox is a Linux container; Windows and macOS commands are refused. A script that behaves differently on Windows or macOS is only tested as Linux.
- 60 seconds, no internet. Every host name resolves to a fake server that records the request and answers nothing useful, so code the command would download is never fetched.
- Clean is not safe. A clean result means nothing suspicious was seen in this run. It is not a promise that the command is safe on your machine.