PluginStatsEvil Merge Detector installs statistics
By fimskiy · GitHub Marketplace
Detect merge commits that introduce code not present in either parent branch
Evil Merge Detector has 2 recorded installs on GitHub Marketplace.
It ranks #1250 of 1,393 tracked GitHub Marketplace listings by installs.
PluginStats has 1 daily observations since Oct 16, 2026; the latest is from Oct 16, 2026.
About Evil Merge Detector
Evil Merge Detector scans every pull request for evil merges — merge commits that introduce code not present in either parent branch. Git's three-way merge outputs files unchanged when both parents are identical; the only way to get a different result is to manually edit files during the merge. This is invisible to GitHub's PR diff, git log, and SAST tools — injected code never appears in any branch review and can run undetected for months.
Capabilities
• Scans every pull request for evil merges and posts results as a GitHub Check Run on the PR. • Replays Git's three-way merge against the merge base and compares the reconstructed result with the actual merge commit, file by file. • Severity levels critical, warning, info, with per-file side-by-side diff of expected vs actual merge content inside the check output. • Runs a one-time historical scan on first install; every new PR is checked automatically.
Benefits
• Closes a blind spot in code review: evil merges are invisible to GitHub's PR diff, git blame, and SAST tools. • Defends against a documented supply chain attack — files manually edited during a merge to inject code missing from either parent. • Zero workflow changes: install once at the org level, no .github/workflows, no secrets, no CI config.
Getting Started
Requirements: an organization owner (or a user with install permission) installs the app. Permissions: read code, pull requests, metadata; write checks. Generally available, no waitlist.
Setup:
• Click Install it for free (or Set up a plan for Pro) and select the organization. • Choose All repositories or specific ones, then approve the permissions. • Open any pull request with a merge commit — the check runs automatically; past merges are scanned in the background.
Usage
Every PR with merge commits gets an Evil Merge Detector check: pass, neutral (review listed files), or failure (critical finding). The check shows the merge commit hash, author, affected files, and a per-file diff of expected vs actual merge content. Pro adds scan history at evilmerge.dev/dashboard with Slack and webhook notifications.
Description from the GitHub Marketplace listing.
- Security
Where Evil Merge Detector sits in the listing
Each band is one page of 20. Installs on a log scale. Placement is projected from installs, so it can differ from the marketplace's own sort order. Hover a dot to see the listing.
Charts
Images: 30d · 1y · all time · 1600×900 dark
Adoption over time
7/30/90-day growth
Filled points are observed values; hollow points come from Internet Archive snapshots of the listing page. Dashed segments span periods with no observations — values between points are not interpolated.
Recent observations
Full history (1)Similar GitHub Marketplace plugins
Data source
Install counts (installations of each GitHub App across accounts and organizations) are read from public GitHub Marketplace listing pages. GitHub does not publish ratings. Category positions reflect GitHub's own popularity sort.
Listing: https://github.com/marketplace/evil-merge-detector. First seen Oct 16, 2026; last successful collection Oct 16, 2026. See the methodology.