github.com / Deftera186

Deftera186/tennoscope

Rust·237 files·commit 139f36c·scanned 6d ago·cached ✓

45/100

SUSPICIOUS

Obfuscation or dynamic code paths detected. Intent unclear — review before running anything.

verdict accurate?

Created 24 days ago

Desktop app detected

threat-state: suspiciouslive

FINDINGS ░▒▓

criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.app/src-tauri/src/reward_ocr.rs

fn xwininfo_tree() -> String {
    Command::new("xwininfo")
        .args(["-root", "-tree"])
        .output()

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.crates/warframe-market/src/http.rs

//!
//! Deliberately thin. Everything worth testing -- what a signin body looks like, which status
//! means an expired credential, how an order parses -- lives in a module that takes a transport,
//!...

/// otherwise become a malformed frame the server answers with a close.
pub fn sign_in_frame(token: &str) -> String {
    serde_json::json!({
        "route": "@wfm|cmd/auth/signIn",

//!
//! It signs in with the credential the app already holds, walks statuses online, invisible,
//! in-game, and online again on one connection, and closes -- so the app must be closed while
//! this...

warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.app/src/App.tsx+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.app/src/App.tsx+3

warningHigh-entropy string literalsFound 5 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.app/src/freshness.ts+3

warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.scripts/scan_response_records.py+3

infoSuspicious file in repoExecutable file (vendor-windows-tesseract.ps1) in repositoryscripts/vendor-windows-tesseract.ps1+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

147 files scanned @ 139f36c | 8/19/2026 | heuristic scan — always review manually

risk by category

code execution10

network & exfiltration15

file system access0

obfuscation12

supply chain2

owasp / injection0

telemetry

files 147/237rules hit 10engine v5commit 139f36c

github

Deftera186/tennoscope

Local-first Warframe companion: relic reward overlay and value advisor

Rust

31d

237 files

147 scanned(62%)

139f36c

architecture░▒▓

entry (1) flagged (7) pkg (79)

215 nodes · 318 edgesscroll to zoom · click node to jump to finding