github.com / FelipePrado0
FelipePrado0/ gow3_pc
C++·941 files·commit 9dd2d12·scanned 4d ago·cached ✓
25/100
LOW RISK
Minor findings consistent with the project type. Nothing reachable from install hooks.
score capped at 25 — 4,083 stars — findings likely legitimate code patterns
verdict accurate?
Created 17 days ago
Created 17 days ago
16% file coverage
threat-state: lowlive
FINDINGS ░▒▓
warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.scripts/legacy.py
try:
proc = subprocess.run(
['powershell', '-NoProfile', '-NonInteractive', '-Command', script],
env=env,+4warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.tests/test_arch_pkgbuild.py
# Only submodule setup is stubbed; run the actual PKGBUILD transformations.
return subprocess.run(
['bash', '-c', 'set -e; source "$1"; srcdir=$2; git() { :; }; prepare',
...+4warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.tests/test_legacy.py
)
self.subprocess.run(['powershell', '-NoProfile', '-NonInteractive', '-Command', script], check=True)
def test_user_created_shortcut_with_custom_name(self):+4warningHigh-entropy string literalsFound 58 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.gpu/third_party/sirit/externals/SPIRV-Headers/include/spirv/unified1/spirv.py+3
infoSuspicious file in repoVery large source file (516KB) — could contain obfuscated payloadgpu/third_party/sirit/externals/SPIRV-Headers/include/spirv/unified1/spirv.core.grammar.json+2
infoSuspicious file in repoExecutable file (smoke-test.ps1) in repositorypackaging/windows/smoke-test.ps1+2
Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.
153 files scanned @ 9dd2d12 | 10/25/2026 | heuristic scan — always review manually
risk by category
code execution18
network & exfiltration0
file system access0
obfuscation3
supply chain4
owasp / injection0
telemetry
files 153/941rules hit 7engine v7commit 9dd2d12
github
FelipePrado0/gow3_pc
SpartanPort: unofficial PC port of God of War III Remastered (PS4) for Windows and Linux (AppImage). Original x86-64 code runs directly on the CPU with a custom runtime; graphics use shadPS4's Vulkan video core. Launcher, in-game menu, controller icons and up to 240 FPS. Requires your own game dump. No game files included.
4083
268
22d
941 files
153 scanned(16%)
9dd2d12
architecture░▒▓
entry (1) flagged (5) pkg (81)
188 nodes · 518 edgesscroll to zoom · click node to jump to finding