DANGER
malware detected
github.com / LifetimeLabsDev
LifetimeLabsDev/ PrivacyNotes.app
TypeScript·1950 files·commit 074b769·scanned 2d ago·cached ✓
90/100
MALICIOUS
Matches known-malicious patterns. Do not clone or install.
This repository contains patterns associated with malware. Do NOT run this code.
verdict accurate?
Crypto/Web3 project
Partial architecture graph
Desktop app detected
threat-state: maliciouslive
FINDINGS ░▒▓
warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.application/packages/desktop/src-tauri/plugins/auth-session/src/ios.rs
});
unsafe { msg_send![super(this), init] }
}
}+3warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.application/packages/desktop/src-tauri/src/biometric.rs
let class = AnyClass::get(c"LAContext")?;
Some(unsafe { msg_send![class, new] })
}
+3warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.application/packages/desktop/src-tauri/src/file_assoc.rs
// Copy rule, so this neither leaks nor over-releases.
unsafe {
let raw = LSCopyDefaultRoleHandlerForContentType(&*uti, role);
Retained::from_raw(raw)+3criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.application/packages/desktop/src-tauri/src/file_assoc.rs
pub fn status(app: &tauri::AppHandle) -> AssocStatus {
let Ok(out) = Command::new("xdg-mime")
.args(["query", "default", MARKDOWN_MIMES[0]])
.output()+8criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.application/packages/desktop/src-tauri/src/lib.rs
use std::os::unix::process::CommandExt;
let err = std::process::Command::new(exe).args(kept).exec();
eprintln!("could not restart without the non-Unicode arguments:...+8criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.application/packages/desktop/src-tauri/patches/swift-rs/src-rs/build.rs
let swift_target_info_str = Command::new("swift")
.args(["-target", &target, "-print-target-info"])
.output()+8criticalSuspicious code is reachable from an entry pointFlagged files are imported by the application's entry path: application/packages/web/src/builtinThemeCodes.ts, application/packages/web/src/communityThemes.ts, application/packages/web/help-page.ts. This means the suspicious code can execute when the app runs.+8
warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.application/packages/desktop/src-tauri/src/clip_fetch.rs
//! way; //! - an address assigned to this device is refused too, which catches a //! global IPv6 address that routes back to it; //! - the ports browsers refuse (the Fetch standard's bad-port lis...+5
warningSeed phrase / private key harvesting UICollects seed phrase, private key, or mnemonic from the user via input/textarea/clipboard/prompt. Wallet drainers and fake wallet apps use this to steal funds.application/packages/web/src/SshKeyForm.tsx
label: string; privateKey: string; publicKey: string; passphrase: string;+5
warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.application/packages/web/src/locales/ar/common.json
"downloadPrivateKey": "تنزيل المفتاح الخاص",
"downloadHint": "انقل المفتاح الذي نزّلته إلى ~/.ssh ونفّذ عليه chmod 600، وإلا سيرفضه ssh.",
"downloadFailed": "تعذّر حفظ ملف المفتاح. تحقّق...+5warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.application/packages/web/src/locales/ca/common.json
"downloadPrivateKey": "Baixa la clau privada",
"downloadHint": "Mou la clau baixada a ~/.ssh i executa-hi chmod 600, o ssh la rebutjarà.",
"downloadFailed": "No s'ha pogut desar el fitxer ...+5warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.application/packages/web/src/locales/cs/common.json
"downloadPrivateKey": "Stáhnout privátní klíč",
"downloadHint": "Přesuň stažený klíč do ~/.ssh a spusť na něj chmod 600, jinak ho ssh odmítne.",
"downloadFailed": "Soubor s klíčem se nepod...+5warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.application/packages/desktop/src-tauri/patches/tauri-plugin-notification/src/init-iife.js+4
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.application/packages/desktop/src-tauri/patches/tauri-plugin-notification/api-iife.js+4
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.application/packages/web/help-page.ts+4
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.application/packages/web/src/AppearanceSheet.tsx+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.application/packages/web/src/LandingPage.tsx+3
warningHigh-entropy string literalsFound 5 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.application/packages/web/src/builtinThemeCodes.ts+3
warningHigh-entropy string literalsFound 14 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.application/packages/web/src/communityThemes.ts+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.application/packages/web/src/ui/Button.tsx+3
infoSuspicious file in repoExecutable file (gradlew.bat) in repositoryapplication/packages/desktop/src-tauri/gen/android/gradlew.bat+2
Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.
1232 files scanned @ 074b769 | 10/27/2026 | heuristic scan — always review manually
risk by category
code execution25
network & exfiltration5
file system access20
obfuscation15
supply chain2
owasp / injection0
telemetry
files 1232/1950rules hit 24engine v7commit 074b769
github
LifetimeLabsDev/PrivacyNotes.app
End-to-end encrypted notes, tasks, files, passwords, journal and bookmarks. Keyed by a 12-word BIP-39 phrase: no email, no password, no account to leak. The full client source for web, desktop and mobile is published, along with the encryption (XChaCha20-Poly1305, HKDF-SHA256, Ed25519) and the threat model, so the privacy claims are falsifiable.
573
41
179d
1950 files
1232 scanned(63%)
074b769
architecture░▒▓
entry (1) flagged (32) pkg (159)
559 nodes · 1943 edgesscroll to zoom · click node to jump to finding