github.com / ImAiiR

ImAiiR/QobuzDownloaderX

C#·103 files·commit 5d03043·scanned 3h ago·cached ✓

11/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

verdict accurate?

9% file coverage

threat-state: lowlive

FINDINGS ░▒▓

warningSuspicious Windows batch commandBatch file contains commands commonly used to download and execute remote payloads (powershell, certutil, bitsadmin, curl to pipe, etc.)._Clean bin folders.cmd

IF EXIST "%~dp1" (
	powershell -noprofile -command ^
	    "$xml = '<?xml version=\"1.0\" encoding=\"utf-8\"?>' + \"`r`n\" + " ^
	    "'<settings>' + \"`r`n\" + " ^

infoSuspicious file in repoExecutable file (_Clean bin folders.cmd) in repository_Clean bin folders.cmd+2

infoAuthor has no other public repositoriesGitHub user "Codex" has no other public repositories, common for burner accounts used in scams.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

9 files scanned @ 5d03043 | 10/30/2026 | heuristic scan — always review manually

risk by category

code execution5

network & exfiltration0

file system access0

obfuscation0

supply chain4

owasp / injection0

telemetry

files 9/103rules hit 3engine v10commit 5d03043

github

ImAiiR/QobuzDownloaderX

QBDLX is a program that downloads streams directly from Qobuz

1280

168

2555d

103 files

9 scanned(9%)

5d03043

network indicators░▒▓

Hosts this code names or would connect to. 4 found, decoded and call-site destinations first. Informational, not scored.

https://www.qobuz.comurlQobuzDownloaderX/Resources/Languages/de.json:65 +6 more
https://github.com/ElektroStudiosurlQobuzDownloaderX/Resources/Languages/es.json:2
https://github.com/Kuzmich55urlQobuzDownloaderX/Resources/Languages/ru.json:2
https://justanothermusic.site/styles/pach/logo.pngurlQobuzDownloaderX/Resources/themes.json:720

architecture░▒▓

No architecture graph available. This usually happens when the repo contains no scannable JS/TS/Python files or only a single file was analyzed.