paste-guard

github.com ↗

Detects pasted commands and requires a confirmation phrase before execution to prevent clipboard injection attacks (MITRE ATT&CK T1204.004). Reads confirmation from /dev/tty so attackers cannot embed the confirmation in the payload.