GitHub Repository

You've been pinched. Now get unpinched. Find out if PinchTab is running on your host before someone else does.

11 starsGo

Unpinched – open-source PinchTab and CDP bridge detector

Name: Unpinched – open-source PinchTab and CDP bridge detector
Availability: InStock
Author: Siri_D

by Siri_D·Mar 9, 2026·1 point·0 comments

Visit Project View on HN

AI Analysis

●●SolidDark HorseNiche Gem

CDP-based attack detection that EDR tools miss, backed by published research.

Strengths

•Addresses genuine blind spot in conventional endpoint security stacks
•Single binary runs in ~3 seconds with no installation required
•GitHub Action integration for CI deploy gating on clean scans

Weaknesses

•Narrow scope targeting one specific attack vector only
•Utility depends on PinchTab adoption in the wild

Post Description

We published a free CLI tool after writing about PinchTab — a browser hijacking technique that abuses Chrome DevTools Protocol to give attackers (or compromised AI agents) silent access to live browser sessions. No malware signature. No process injection. Most EDRs don't see it at all.

Unpinched is a point-in-time scanner — think nmap for PinchTab presence. Single Go binary, no install required, runs in ~3 seconds.

It checks four things: - Local ports for a PinchTab HTTP API server (with signature verification) - Running processes matching known PinchTab binary names - Unauthenticated CDP exposure on localhost:9222 - Known filesystem artifact paths across macOS, Linux, Windows

Also ships as a GitHub Action so you can gate deploys on a clean scan result.

GitHub: https://github.com/Helixar-AI/Unpinched

The underlying research on why CDP-based attacks evade conventional security stacks is here if you're curious: https://helixar.ai/press/pinchtab-stealth-browser-attacks-yo...

Happy to answer questions on the detection logic or the threat model.