DANGER

malware detected

github.com / MozagaFoundation

MozagaFoundation/Spectra

TypeScript·1531 files·commit d15c8db·scanned 5d ago·cached ✓

100/100

MALICIOUS

the repository contains seed phrase and private key handling in test files, which is common in security research and testing. the readme indicates the project is privacy-focused and security-sensitive.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?

Created 0 days ago

No stars or forks

Crypto/Web3 project

Created in the last 7 days

No community activity

Partial architecture graph

threat-state: maliciouslive

FINDINGS ░▒▓

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

infoLLM: classified as security tool / researchAI analysis classified this repo as a security tool, POC, or research project with medium confidence. It may implement dangerous capabilities, but the stated intent appears legitimate. the repository contains seed phrase and private key handling in test files, which is common in security research and testing. the readme indicates the project is privacy-focused and security-sensitive.+0

warningSeed phrase / private key harvesting UICollects seed phrase, private key, or mnemonic from the user via input/textarea/clipboard/prompt. Wallet drainers and fake wallet apps use this to steal funds.packages/spectra-core-crypto/src/client/chat.test.ts

  privateBundle: {
    identityPrivateKey: 'local-identity-private',
    mlkemIdentityPrivateKey: 'local-mlkem-private',
    dilithiumPrivateKey: 'local-dilithium-private',

      bob.identity.dilithiumPublicKey,
      bob.identity.dilithiumPrivateKey,
      1_771_000_000_000,
    ),

infoWallet transaction signing APIUses wallet signing APIs (signTransaction, signMessage, sendTransaction, etc.). Legitimate in DeFi apps, but combined with remote exfiltration it is the core drainer pattern.packages/spectra-identity-vault/src/keyGeneration.integration.test.ts

    const wallet = await importWalletFromMnemonic(mnemonic, 'Primary')
    const signatureHex = await signMessage('identity-vault audit', wallet.privateKey)
    const dilithium = await Dilithium.init(...


export async function signMessage(
  message: string | Uint8Array,
  privateKeyHex: string,

  }
  const signature = await signMessage(challenge.challenge, wallet.privateKey, {
    domain: WALLET_AUTH_SIGNATURE_DOMAIN,
  })


const MNEMONIC_WORD_COUNT = 24
const MNEMONIC_INPUT_ACCESSORY_ID = 'mnemonic-keyboard-accessory'

criticalSecret collection in crypto contextCollects seed phrases, private keys, or clipboard content while also targeting browser wallets. This is a wallet-stealer pattern.+10

warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.supabase/functions/_shared/auth.ts+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.supabase/functions/_shared/auth.ts+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.supabase/functions/_shared/wallet.ts+3

warningLarge hex-encoded blobA 390-character hex blob was found. Often used to hide shellcode or C2 addresses.packages/spectra-core-crypto/src/ble/protocol.test.ts

0x5342523202010305d0d1d2d3d4d5d6d7d8d9dadbdcdddedf1011121314...

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.packages/spectra-core-crypto/src/client/attachmentDiagnostics.ts+3

warningHigh-entropy string literalsFound 5 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.packages/spectra-core-crypto/src/client/session.ts+3

warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.packages/spectra-core-crypto/src/crypto/mlkem.ts+3

warningLarge base64-encoded blobA 132-character base64 blob was found. May hide a remote payload or encoded executable code.packages/spectra-identity-vault/src/chainKeyDerivation.test.ts

0x0437b0bb7a8288d38ed49a524b5dc98cff3eb5ca824c9f9dc0dfdb3d9c...

warningLarge hex-encoded blobA 132-character hex blob was found. Often used to hide shellcode or C2 addresses.packages/spectra-identity-vault/src/chainKeyDerivation.test.ts

0x0437b0bb7a8288d38ed49a524b5dc98cff3eb5ca824c9f9dc0dfdb3d9c...

warningLarge base64-encoded blobA 512-character base64 blob was found. May hide a remote payload or encoded executable code.packages/spectra-privacy-protocol/src/spectreBlindToken.test.ts

d0a80ef6e324476f2f29099c7c9064e2562684e1c6470c74b79811d37d48...

warningLarge hex-encoded blobA 514-character hex blob was found. Often used to hide shellcode or C2 addresses.packages/spectra-privacy-protocol/src/spectreBlindToken.test.ts

0x51d8f291c6d4c6cea6cdaeaefb2fbadb0bd72d3dd104b2aea00bdf4639...

warningLarge base64-encoded blobA 512-character base64 blob was found. May hide a remote payload or encoded executable code.packages/spectra-privacy-protocol/src/vdf.test.ts

d0a80ef6e324476f2f29099c7c9064e2562684e1c6470c74b79811d37d48...

infoSuspicious file in repoExecutable file (gradlew.bat) in repositoryandroid/gradlew.bat+2

infoSuspicious file in repoVery large source file (612KB) — could contain obfuscated payloadpackage-lock.json+2

infoNative addon dependency"react-native" includes native compiled code. Native addons can hide behavior that static JS analysis cannot see.package.json+2

warningSingle-commit repositoryThe repository has only one commit. This is common for generated or throwaway malware repos.+3

warningHardcoded secret/credentialAPI keys, passwords, or tokens hardcoded in source code. Should be in environment variables.lib/constants.ts

  PENDING_SPECTRE_REMOTE_ACTIVATION: 'exo_pending_spectre_remote_activation',
  PENDING_SPECTRE_BLIND_TOKEN: 'exo_pending_spectre_blind_token',
  PENDING_ACCOUNT_DELETION: 'spectra_pending_account_del...

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

1073 files scanned @ d15c8db | 8/19/2026 | heuristic scan — always review manually

risk by category

code execution2

network & exfiltration0

file system access20

obfuscation15

supply chain9

owasp / injection3

llm second opinion

LLM: classified as security tool / research

AI analysis classified this repo as a security tool, POC, or research project with medium confidence. It may implement dangerous capabilities, but the stated intent appears legitimate. the repository contains seed phrase and private key handling in test files, which is common in security research and testing. the readme indicates the project is privacy-focused and security-sensitive.

confidence medium · informs the score, does not decide it

telemetry

files 1073/1531rules hit 26engine v5commit d15c8db

github

MozagaFoundation/Spectra

Privacy-focused wallet-linked messaging app with end-to-end encryption, Supabase backend, Tor-aware transport, and auditable crypto packages.

TypeScript

1531 files

1073 scanned(70%)

d15c8db

architecture░▒▓

entry (1) flagged (189) pkg (279)

679 nodes · 2163 edgesscroll to zoom · click node to jump to finding