live · scanning repos
Scanrepo
github.com
DANGER
malware detected
github.com / LifetimeLabsDev

LifetimeLabsDev/PrivacyNotes.app

TypeScript·1950 files·commit 074b769·scanned 2d ago·cached ✓
90/100
MALICIOUS
Matches known-malicious patterns. Do not clone or install.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?
Crypto/Web3 project
Partial architecture graph
Desktop app detected
threat-state: maliciouslive

FINDINGS ░▒▓

warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.application/packages/desktop/src-tauri/plugins/auth-session/src/ios.rs
        });
        unsafe { msg_send![super(this), init] }
    }
}
+3
warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.application/packages/desktop/src-tauri/src/biometric.rs
        let class = AnyClass::get(c"LAContext")?;
        Some(unsafe { msg_send![class, new] })
    }
+3
warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.application/packages/desktop/src-tauri/src/file_assoc.rs
        // Copy rule, so this neither leaks nor over-releases.
        unsafe {
            let raw = LSCopyDefaultRoleHandlerForContentType(&*uti, role);
            Retained::from_raw(raw)
+3
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.application/packages/desktop/src-tauri/src/file_assoc.rs
    pub fn status(app: &tauri::AppHandle) -> AssocStatus {
        let Ok(out) = Command::new("xdg-mime")
            .args(["query", "default", MARKDOWN_MIMES[0]])
            .output()
+8
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.application/packages/desktop/src-tauri/src/lib.rs
            use std::os::unix::process::CommandExt;
            let err = std::process::Command::new(exe).args(kept).exec();
            eprintln!("could not restart without the non-Unicode arguments:...
+8
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.application/packages/desktop/src-tauri/patches/swift-rs/src-rs/build.rs

        let swift_target_info_str = Command::new("swift")
            .args(["-target", &target, "-print-target-info"])
            .output()
+8
criticalSuspicious code is reachable from an entry pointFlagged files are imported by the application's entry path: application/packages/web/src/builtinThemeCodes.ts, application/packages/web/src/communityThemes.ts, application/packages/web/help-page.ts. This means the suspicious code can execute when the app runs.+8
warningCluster of suspicious files reachable from entry6 flagged files form a connected cluster that is reachable from an entry point, suggesting coordinated malicious behavior rather than isolated false positives.+5
infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2
warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.application/packages/desktop/src-tauri/src/clip_fetch.rs
//!   way;
//! - an address assigned to this device is refused too, which catches a
//!   global IPv6 address that routes back to it;
//! - the ports browsers refuse (the Fetch standard's bad-port lis...
+5
warningSeed phrase / private key harvesting UICollects seed phrase, private key, or mnemonic from the user via input/textarea/clipboard/prompt. Wallet drainers and fake wallet apps use this to steal funds.application/packages/web/src/SshKeyForm.tsx
  label: string;
  privateKey: string;
  publicKey: string;
  passphrase: string;
+5
warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.application/packages/web/src/locales/ar/common.json
    "downloadPrivateKey": "تنزيل المفتاح الخاص",
    "downloadHint": "انقل المفتاح الذي نزّلته إلى ‎~/.ssh‎ ونفّذ عليه chmod 600، وإلا سيرفضه ssh.",
    "downloadFailed": "تعذّر حفظ ملف المفتاح. تحقّق...
+5
warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.application/packages/web/src/locales/ca/common.json
    "downloadPrivateKey": "Baixa la clau privada",
    "downloadHint": "Mou la clau baixada a ~/.ssh i executa-hi chmod 600, o ssh la rebutjarà.",
    "downloadFailed": "No s'ha pogut desar el fitxer ...
+5
warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.application/packages/web/src/locales/cs/common.json
    "downloadPrivateKey": "Stáhnout privátní klíč",
    "downloadHint": "Přesuň stažený klíč do ~/.ssh a spusť na něj chmod 600, jinak ho ssh odmítne.",
    "downloadFailed": "Soubor s klíčem se nepod...
+5
criticalSecret collection in crypto contextCollects seed phrases, private keys, or clipboard content while also targeting browser wallets. This is a wallet-stealer pattern.+10
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.application/packages/desktop/src-tauri/patches/tauri-plugin-notification/src/init-iife.js+4
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.application/packages/desktop/src-tauri/patches/tauri-plugin-notification/api-iife.js+4
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.application/packages/web/help-page.ts+4
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.application/packages/web/src/AppearanceSheet.tsx+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.application/packages/web/src/LandingPage.tsx+3
warningHigh-entropy string literalsFound 5 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.application/packages/web/src/builtinThemeCodes.ts+3
warningHigh-entropy string literalsFound 14 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.application/packages/web/src/communityThemes.ts+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.application/packages/web/src/ui/Button.tsx+3
infoSuspicious file in repoExecutable file (gradlew.bat) in repositoryapplication/packages/desktop/src-tauri/gen/android/gradlew.bat+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

1232 files scanned @ 074b769 | 10/27/2026 | heuristic scan — always review manually

risk by category
code execution25
network & exfiltration5
file system access20
obfuscation15
supply chain2
owasp / injection0
telemetry
files 1232/1950rules hit 24engine v7commit 074b769

github

LifetimeLabsDev/PrivacyNotes.app

End-to-end encrypted notes, tasks, files, passwords, journal and bookmarks. Keyed by a 12-word BIP-39 phrase: no email, no password, no account to leak. The full client source for web, desktop and mobile is published, along with the encryption (XChaCha20-Poly1305, HKDF-SHA256, Ed25519) and the threat model, so the privacy claims are falsifiable.

TypeScript
573
41
179d
1950 files
1232 scanned(63%)
074b769

architecture░▒▓

entry (1) flagged (32) pkg (159)
559 nodes · 1943 edgesscroll to zoom · click node to jump to finding
⚠️ MALICIOUS (90/100) — LifetimeLabsDev/PrivacyNotes.app — ScanRepo