DANGER

malware detected

github.com / Ahmadkhattak1

Ahmadkhattak1/awesome-downloader

JavaScript·86 files·commit 4415990·scanned 3h ago·cached ✓

70/100

DANGEROUS

Sensitive capability combinations reachable from entry points. Do not run without review.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?

Created 6 days ago

Created in the last 7 days

threat-state: dangerouslive

FINDINGS ░▒▓

what this code does░▒▓

What happens when you open, install or run it, from the findings below.

when rundesktop/browser-registration.cjs and desktop/browser-setup.cjs reference browser profile paths, where saved logins and cookies live. desktop/browser-registration.cjs, desktop/browser-setup.cjs

warningVM code executionvm.runInNewContext or similar can execute arbitrary code in a sandboxed context that may be escaped.extension/background.test.cjs

  browser.tabs.sendMessage=async()=>({ok:true});
  vm.runInNewContext(fs.readFileSync(path.join(__dirname,'background.js'),'utf8'),{browser,URL,URLSearchParams,Uint8Array,btoa:value=>Buffer.from(value...

warningVM code executionvm.runInNewContext or similar can execute arbitrary code in a sandboxed context that may be escaped.extension/lifecycle.test.cjs

  const context={chrome:{runtime},document,location:{href:'https://www.youtube.com/watch?v=wLdZWyLOJCI',origin:'https://www.youtube.com'},window:{},URL,AbortController,ResizeObserver:Observer,Mutation...

warningVM code executionvm.runInNewContext or similar can execute arbitrary code in a sandboxed context that may be escaped.extension/menu-behavior.test.cjs

  const context = { globalThis: {} };
  vm.runInNewContext(fs.readFileSync(path.join(__dirname, 'menu-behavior.js'), 'utf8'), context);
  return context.globalThis.awesomeMenuResult;
}

criticalSuspicious code is reachable from an entry pointFlagged files are imported by the application's entry path: desktop/browser-registration.cjs, desktop/browser-setup.cjs. This means the suspicious code can execute when the app runs.+8

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.desktop/browser-registration.cjs

  Edge: { registry: 'Microsoft\\Edge', data: 'Microsoft/Edge/User Data', dataRoot: 'local' },
  Brave: { registry: 'BraveSoftware\\Brave-Browser', data: 'BraveSoftware/Brave-Browser/User Data', dataRo...

+10

criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.desktop/browser-setup.cjs

  Chrome: { url: 'chrome://extensions/', candidates: [
    ['LOCALAPPDATA', 'Google/Chrome/Application/chrome.exe'], ['ProgramFiles', 'Google/Chrome/Application/chrome.exe'], ['ProgramFiles(x86)', 'Go...

+10

criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.integration/browser-registration.test.cjs

  assert.equal(browserSpec('Edge').registry,'Microsoft\\Edge');
  assert.equal(browserSpec('Brave').registry,'BraveSoftware\\Brave-Browser');
  assert.equal(browserSpec('Firefox').firefox,true);
  ass...

+10

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.renderer/app.js+4

infoSuspicious file in repoExecutable file (package-extension.ps1) in repositoryintegration/package-extension.ps1+2

infoSuspicious file in repoExecutable file (package-firefox-extension.ps1) in repositoryintegration/package-firefox-extension.ps1+2

infoSuspicious file in repoExecutable file (register-native-host.ps1) in repositoryintegration/register-native-host.ps1+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

50 files scanned @ 4415990 | 10/30/2026 | heuristic scan — always review manually

risk by category

code execution22

network & exfiltration0

file system access20

obfuscation4

supply chain6

owasp / injection0

telemetry

files 50/86rules hit 12engine v10commit 4415990

github

Ahmadkhattak1/awesome-downloader

Open-source Windows download manager with browser video integration

JavaScript

165

86 files

50 scanned(58%)

4415990

network indicators░▒▓

Hosts this code names or would connect to. 12 found, decoded and call-site destinations first. Informational, not scored.

https://www.youtube.com/watchurlnext to execcore/youtube.mjs:13 +12 more
https://googlevideo.com/videoplaybackurlextension/background.js:40
https://r1.googlevideo.com/videoplaybackurlnext to network calltest onlyextension/background.test.cjs:30 +12 more
https://www.youtube.comurlextension/manifest.firefox.json:13 +4 more
https://youtube.comurlextension/manifest.firefox.json:13 +3 more
https://m.youtube.comurlextension/manifest.firefox.json:13 +3 more
https://video.twimg.com/amplify_video/123/urltest onlyextension/media-choices.test.cjs:4
https://video.twimg.com/amplify_video/456/other.mp4urltest onlyextension/media-choices.test.cjs:9
https://pbs.twimg.com/amplify_video_thumb/123/img/a.jpgurltest onlyextension/media-choices.test.cjs:10
https://youtu.be/wLdZWyLOJCIurltest onlytests/youtube.test.mjs:12
https://youtube.com/s/search/audio/no_input.mp3urltest onlytests/youtube.test.mjs:13
https://youtube.com/watchurltest onlytests/youtube.test.mjs:13

architecture░▒▓

entry (1) flagged (7) pkg (6)

52 nodes · 48 edgesscroll to zoom · click node to jump to finding