live · scanning repos
Scanrepo
github.com
github.com / 0xCodez

0xCodez/cleanly

TypeScript·77 files·commit 1c4109b·scanned 3h ago·cached ✓
44/100
SUSPICIOUS
Obfuscation or dynamic code paths detected. Intent unclear — review before running anything.
verdict accurate?
Created 1 days ago
Created in the last 7 days
Electron app detected
threat-state: suspiciouslive

FINDINGS ░▒▓

what this code does░▒▓

What happens when you open, install or run it, from the findings below.

  1. when runsrc/mock.ts and electron/services/junk.ts reference browser profile paths, where saved logins and cookies live. src/mock.ts, electron/services/junk.ts
  2. when runelectron/services/junk.ts and electron/services/spaces.ts start system processes. electron/services/junk.ts, electron/services/spaces.ts
  3. when runelectron/services/trash.ts references SSH key or cloud credential paths (such as ~/.ssh or ~/.aws/credentials). electron/services/trash.ts
criticalchild_process / exec usageExecuting shell commands can be used to download and run malware, exfiltrate data, or modify system files.electron/services/junk.ts
  return new Promise((resolve, reject) => {
    execFile(
      path.join(process.env.SystemRoot ?? process.env.windir ?? 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe'),
   ...
+8
criticalchild_process / exec usageExecuting shell commands can be used to download and run malware, exfiltrate data, or modify system files.electron/services/spaces.ts
  return new Promise((resolve) => {
    execFile(
      sys32('WindowsPowerShell', 'v1.0', 'powershell.exe'),
      ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', script],
+8
infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2
criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.src/mock.ts
      locations: [
        tilde(join(HOME, 'AppData', 'Local', 'Google', 'Chrome', 'User Data', 'Default', 'Cache')),
        tilde(join(HOME, 'AppData', 'Local', 'Microsoft', 'Edge', 'User Data', 'D...
+10
criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.electron/services/junk.ts
          path.join(L, 'Microsoft', 'Edge', 'User Data'),
          path.join(L, 'BraveSoftware', 'Brave-Browser', 'User Data'),
          path.join(L, 'Vivaldi', 'User Data'),
        ];
+10
warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.electron/services/trash.ts
const SECRET_DIRS = [
  '.ssh', '.gnupg', path.join('Library', 'Keychains'),
  path.join('AppData', 'Roaming', 'Microsoft', 'Protect'),
  path.join('AppData', 'Roaming', 'Microsoft', 'Credentials'),
+5

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

53 files scanned @ 1c4109b | 10/30/2026 | heuristic scan — always review manually

risk by category
code execution18
network & exfiltration0
file system access20
obfuscation0
supply chain0
owasp / injection0
telemetry
files 53/77rules hit 6engine v10commit 1c4109b

github

0xCodez/cleanly

Cleanly — a stylish, safe PC cleaner for Windows and macOS

TypeScript
133
16
1d
77 files
53 scanned(69%)
1c4109b

network indicators░▒▓

Hosts this code names or would connect to. 11 found, decoded and call-site destinations first. Informational, not scored.

architecture░▒▓

entry (0) flagged (4) pkg (9)
59 nodes · 199 edgesscroll to zoom · click node to jump to finding