github.com / Bennettxai

Bennettxai/FounderOS-DEMO

TypeScript·1687 files·commit fb974bf·scanned 4d ago·cached ✓

25/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 25 — 1,246 stars — findings likely legitimate code patterns

verdict accurate?

Partial architecture graph

threat-state: lowlive

FINDINGS ░▒▓

criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.tests/appearance.test.ts

  const window = { matchMedia: () => mq };
  new Function('localStorage', 'document', 'window', 'location', APPEARANCE_INIT_SCRIPT)(localStorage, document, window, { search: opts.search ?? '' });
  re...

criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.tests/fo-fixups.test.ts

      const storage = { getItem: (k: string) => (k === SIDEBAR_STORAGE_KEY ? JSON.stringify({ v: 2, w: 232 }) : null) };
      new Function('document', 'localStorage', 'location', 'innerWidth', SIDEBA...

criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.tests/g-audit-lib.test.ts

    expect(parseMasks([])['/compute']).toHaveLength(1);
    for (const expr of Object.values(CLASSIC_MASKS)) expect(() => new Function(`return ${expr}`)).not.toThrow();
    const m = parseMasks(['--cl...

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.lib/creative-engine/demo.ts+4

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.components/creative-engine/CreativeGenerator.tsx+3

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

1651 files scanned @ fb974bf | 10/25/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration0

file system access0

obfuscation15

supply chain0

owasp / injection0

telemetry

files 1651/1687rules hit 8engine v7commit fb974bf

github

Bennettxai/FounderOS-DEMO

An open-source, single-operator business command center: run a one-person operated company as AI-assisted departments (comms, funnel, social, finances, agents, and a knowledge graph) from one live dashboard.

TypeScript

1246

346

114d

1687 files

1651 scanned(98%)

fb974bf

architecture░▒▓

entry (2) flagged (19) pkg (559)

959 nodes · 1970 edgesscroll to zoom · click node to jump to finding