github.com / GatherPress

GatherPress/gatherpress

PHP·1085 files·commit ece4892·scanned 4d ago·cached ✓

11/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

verdict accurate?

36% file coverage

threat-state: lowlive

FINDINGS ░▒▓

infoSuspicious file in repoVery large source file (1234KB) — could contain obfuscated payloadpackage-lock.json+2

warningDependency runs install scripts"<root>/postinstall" executes code during installation. Malicious packages use this to drop payloads before the app even runs.package.json+3

infoAuthor has no other public repositoriesGitHub user "github-actions[bot]" has no other public repositories, common for burner accounts used in scams.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

396 files scanned @ ece4892 | 10/25/2026 | heuristic scan — always review manually

risk by category

code execution0

network & exfiltration0

file system access0

obfuscation0

supply chain7

owasp / injection0

telemetry

files 396/1085rules hit 3engine v7commit ece4892

github

GatherPress/gatherpress

Powering our community's event management needs.

PHP

139

2274d

1085 files

396 scanned(36%)

ece4892

architecture░▒▓

entry (1) flagged (0) pkg (118)

434 nodes · 1102 edgesscroll to zoom · click node to jump to finding