DANGER
malware detected
github.com / Bhuzel
Bhuzel/ ZellRayy-Bot
JavaScript·114 files·commit bd8d6a8·scanned 3d ago·cached ✓
70/100
DANGEROUS
Sensitive capability combinations reachable from entry points. Do not run without review.
This repository contains patterns associated with malware. Do NOT run this code.
verdict accurate?
No stars or forks
No community activity
threat-state: dangerouslive
FINDINGS ░▒▓
what this code does░▒▓
What happens when you open, install or run it, from the findings below.
- when runplugins/owner/eval.js builds code from strings at run time with
eval. plugins/owner/eval.js
criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.plugins/owner/eval.js
if (command === '=>') {
result = await eval(`(async (sock, m, chat, sender, config) => { return ${text} })(sock, m, chat, sender, config)`)
} else {
result = await eval(`(a...+8Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.
112 files scanned @ bd8d6a8 | 11/6/2026 | heuristic scan — always review manually
risk by category
code execution10
network & exfiltration0
file system access0
obfuscation0
supply chain0
owasp / injection0
telemetry
files 112/114rules hit 2engine v10commit bd8d6a8
github
Bhuzel/ZellRayy-Bot
Bot Whatsapp By Bhuzel Rayhan | ZellRayy
0
0
94d
114 files
112 scanned(98%)
bd8d6a8
network indicators░▒▓
Hosts this code names or would connect to. 40 found, decoded and call-site destinations first. Informational, not scored.
- https://ezgif.com/webp-to-mp4urlnext to network calllib/converter.js:188
- https://ezgif.com/webp-to-mp4/$urlnext to network calllib/converter.js:202
- https://ipwho.is/$urlnext to network callplugins/tools/cekip.js:19
- https://tinyurl.com/api-create.phpurlnext to network callplugins/tools/shorturl.js:19
- https://translate.googleapis.com/translate_a/singleurlnext to network callplugins/tools/translate.js:26
- https://api.zellrayy.com/assets/logo.pngurlconfig.js:20
- https://api.zellrayy.comurlconfig.js:21 +6 more
- https://ezgif.comurllib/converter.js:216
- https://www.capcut.com/t/xxxurlplugins/downloader/capcut.js:13
- https://www.dailymotion.com/video/xxxurlplugins/downloader/dailymotion.js:13
- https://drive.google.com/file/d/xxx/viewurlplugins/downloader/drive.js:13
- https://github.com/user/repourlplugins/downloader/github.js:13
- https://www.instagram.com/p/xxxurlplugins/downloader/instagram.js:48
- https://www.mediafire.com/file/xxxurlplugins/downloader/mediafire.js:13
- https://pin.it/xxxurlplugins/downloader/pinterest.js:13
- https://soundcloud.com/xxx/xxxurlplugins/downloader/soundcloud.js:13
- https://open.spotify.com/track/xxxurlplugins/downloader/spotify.js:13 +1 more
- https://sticker.ly/s/9E32A2urlplugins/downloader/stickerly.js:14
- https://vt.tiktok.com/xxxxxxxx/urlplugins/downloader/tiktok.js:34
- https://x.com/user/status/xxxurlplugins/downloader/twitter.js:14
- https://youtu.be/xxxurlplugins/downloader/ytmp3.js:13 +1 more
- https://chat.whatsapp.com/$urlplugins/group/linkgroup.js:10
- https://api.github.com/users/octocaturlplugins/owner/fetch.js:19
- https://chat.whatsapp.com/AbCdEfGhIjKurlplugins/owner/join.js:14
- https://whatsapp.com/channel/0029VaXXXXXurlplugins/tools/getidch.js:171
- https://chat.whatsapp.com/…urlplugins/tools/getidgc.js:79
- capcut.comdomainplugins/downloader/capcut.js:12
- dailymotion.comdomainplugins/downloader/dailymotion.js:12
- mediafire.comdomainplugins/downloader/mediafire.js:12
- pinterest.comdomainplugins/downloader/pinterest.js:12
- spotify.comdomainplugins/downloader/spotify.js:12 +1 more
- getstickerpack.comdomainplugins/downloader/stickerly.js:13
- tiktok.comdomainplugins/downloader/tiktok.js:33
- twitter.comdomainplugins/downloader/twitter.js:13
- youtube.comdomainplugins/downloader/ytmp3.js:12 +1 more
- https://wa.me/c/6281234567890urltest onlyplugins/example/tesbutton_catalog.js:9
- https://github.com/…/wesker-boturltest onlyplugins/example/tesbutton_cta.js:10
- https://picsum.photos/800/400urltest onlyplugins/example/tesbutton_image.js:8
- https://google.comurltest onlyplugins/example/tesbutton_image.js:13 +2 more
- global.storedomaincomment onlylib/msgStore.js:6 +1 more
architecture░▒▓
entry (1) flagged (1) pkg (14)
124 nodes · 139 edgesscroll to zoom · click node to jump to finding