live · scanning repos
Scanrepo
github.com
github.com / OmniNull

OmniNull/OmniWM

Swift·3305 files·commit e08c8c5·scanned 17h ago·cached ✓
25/100
LOW RISK
Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 25 — 3,474 stars — findings likely legitimate code patterns

verdict accurate?
2% file coverage
threat-state: lowlive

FINDINGS ░▒▓

what this code does░▒▓

What happens when you open, install or run it, from the findings below.

  1. when runScripts/localization.py starts system processes. Scripts/localization.py
warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.Scripts/localization.py
    output_map.write_text(json.dumps({source: {"ast-dump": str(dump)} for source, dump in dumps.items()}))
    subprocess.run([arguments[0], *kept, "-dump-ast", "-output-file-map", str(output_map)], c...
+4
warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.Tests/DevToolingTests/test_canary_release.py
def run(args, cwd=None):
    result = subprocess.run(args, cwd=cwd, capture_output=True, text=True)
    if result.returncode != 0:
        raise AssertionError(f"{args} failed: {result.stderr}")
+4
warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.Tests/DevToolingTests/test_dev_install.py
    def install(self):
        return subprocess.run(
            ["/bin/bash", str(self.script), "install"],
            env=self.environment,
+4
infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.Scripts/generate_ipc_wire.py+4
warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.Tests/DevToolingTests/test_check_pinned_downloads.py+3
warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.Tests/DevToolingTests/test_release.py+3

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

80 files scanned @ e08c8c5 | 10/30/2026 | heuristic scan — always review manually

risk by category
code execution22
network & exfiltration0
file system access0
obfuscation10
supply chain0
owasp / injection0
telemetry
files 80/3305rules hit 7engine v10commit e08c8c5

github

OmniNull/OmniWM

Free, open-source tiling window manager for Apple Silicon Macs, with Niri-style scrolling containers and Hyprland-style Dwindle BSP.

Swift
3474
159
375d
3305 files
80 scanned(2%)
e08c8c5

network indicators░▒▓

Hosts this code names or would connect to. 44 found, decoded and call-site destinations first. Informational, not scored.

architecture░▒▓

entry (1) flagged (8) pkg (44)
88 nodes · 160 edgesscroll to zoom · click node to jump to finding