live · scanning repos
Scanrepo
github.com
github.com / ExplosiveCoderflome

ExplosiveCoderflome/AI-Novel-Writing-Assistant

TypeScript·3292 files·commit 7f06e54·scanned 9h ago·cached ✓
25/100
LOW RISK
Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 25 — 3,329 stars — findings likely legitimate code patterns

verdict accurate?
Partial architecture graph
threat-state: lowlive

FINDINGS ░▒▓

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.server/tests/testInfrastructure/codePolicy.test.js
test("code policy rejects async Promise executors and executable debug/error shortcuts", () => {
  const errors = inspectSource('new Promise(async (resolve) => resolve(1)); debugger; eval("1"); throw ...
+8
criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.client/tests/novelChapterRouteContracts.test.js
  // Execute the page's cleanup effect against React Router's real memory navigation.
  new Function("location", "navigate", "setSearchParams", "stripLegacyTaskUrlParams", cleanupEffect)(
    location...
+5
infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2
infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.server/src/services/image/imageAssetStorage.ts
    return {
      buffer: Buffer.from(base64Payload, "base64"),
      mimeType,
      sourceUrl: null,
+2
infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.server/src/services/image/runtime/utils.ts
    const [, b64 = ""] = imageUrl.split(",", 2);
    await fs.writeFile(destPath, Buffer.from(b64, "base64"));
  } else {
    const resp = await fetch(imageUrl);
+2
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.client/src/pages/marketRadar/MarketRadarPage.tsx+4
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.client/src/pages/novels/NovelEdit.tsx+4
warningHigh-entropy string literalsFound 7 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.server/src/prompting/prompts/style/diagnostics/index.ts+3
warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.client/src/pages/characters/CharacterLibrary.tsx+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.client/src/pages/directorNext/DirectorNovelPage.tsx+3
warningHigh-entropy string literalsFound 7 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.client/src/pages/directorNext/workspace/previewBook.ts+3

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

2574 files scanned @ 7f06e54 | 10/30/2026 | heuristic scan — always review manually

risk by category
code execution15
network & exfiltration4
file system access0
obfuscation15
supply chain0
owasp / injection0
telemetry
files 2574/3292rules hit 11engine v10commit 7f06e54

github

ExplosiveCoderflome/AI-Novel-Writing-Assistant

面向长篇小说创作的 AI Native 开源系统，用 Agent、世界观、写法引擎、RAG 和整本生产工作流，帮助新手从一句灵感走到完整小说。AI-native engine for end-to-end novel creation — from idea to full chapters, with structured planning, worldbuilding, and agent-driven workflows.

TypeScript
3329
623
620d
3292 files
2574 scanned(78%)
7f06e54

network indicators░▒▓

Hosts this code names or would connect to. 38 found, decoded and call-site destinations first. Informational, not scored.

architecture░▒▓

entry (2) flagged (92) pkg (195)
595 nodes · 1253 edgesscroll to zoom · click node to jump to finding