github.com / DaveMakesWaves

DaveMakesWaves/funsync-player

JavaScript·445 files·commit 147a788·scanned 4d ago·cached ✓

40/100

SUSPICIOUS

Obfuscation or dynamic code paths detected. Intent unclear — review before running anything.

verdict accurate?

Electron app detected

threat-state: suspiciouslive

FINDINGS ░▒▓

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.tests/unit/csp-compliance.test.js


  it('no eval() calls in source files', () => {
    const violations = [];
    for (const file of jsFiles) {

criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.tests/unit/csp-compliance.test.js


  it('no new Function() calls in source files', () => {
    const violations = [];
    for (const file of jsFiles) {

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

400 files scanned @ 147a788 | 10/25/2026 | heuristic scan — always review manually

risk by category

code execution15

network & exfiltration0

file system access0

obfuscation0

supply chain0

owasp / injection0

telemetry

files 400/445rules hit 3engine v7commit 147a788

github

DaveMakesWaves/funsync-player

Local desktop video player with device integration for synchronized funscript playback

JavaScript

195d

445 files

400 scanned(90%)

147a788

architecture░▒▓

entry (1) flagged (1) pkg (69)

459 nodes · 846 edgesscroll to zoom · click node to jump to finding