github.com / OpenWhispr

OpenWhispr/openwhispr

JavaScript·3168 files·commit fef65ff·scanned 5d ago·cached ✓

25/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 25 — 9,763 stars — findings likely legitimate code patterns

verdict accurate?

Partial architecture graph

threat-state: lowlive

FINDINGS ░▒▓

criticalchild_process / exec usageExecuting shell commands can be used to download and run malware, exfiltrate data, or modify system files.src/helpers/downloadUtils.js

const { net } = require("electron");
const { execFile } = require("child_process");
const { pipeline } = require("stream");
const debugLogger = require("./debugLogger");

criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.test/helpers/noteCloudCollision.test.js

  assert.ok(registration, "the cloud-note IPC callback must be present");
  return new Function("broadcastToWindows", "setImmediate", `return (${registration[1]}\n});`).call(
    { databaseManager: db...

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.openwhispr-mobile/src/services/transcription/RealtimeMeetingWsService.ts

  frameSub = addPcmFrameListener((frame: PcmFrame) => {
    enqueuePcm(Buffer.from(frame.audio, 'base64'));
  });
  try {

infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.scripts/stt-canary.mjs

    ],
    { input: Buffer.from(audio, "base64"), maxBuffer: 64 * 1024 * 1024 }
  );
  if (resampled.status !== 0) throw new Error("could not resample the speech fixture to 16kHz");

warningClipboard read accessnavigator.clipboard.readText() reads the user's clipboard. In a wallet/crypto context this is often used to steal copied seed phrases or private keys.src/hooks/useClipboard.ts

        // Fallback to web clipboard API
        const webText = await navigator.clipboard.readText();
        if (webText && webText.trim()) {
          setter(webText.trim());

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.src/config/prompts.ts+3

infoSuspicious file in repoVery large source file (697KB) — could contain obfuscated payloadopenwhispr-mobile/package-lock.json+2

infoSuspicious file in repoVery large source file (501KB) — could contain obfuscated payloadpackage-lock.json+2

infoSuspicious file in repoVery large source file (501KB) — could contain obfuscated payloadsrc/helpers/ipcHandlers.js+2

infoAuthor has no other public repositoriesGitHub user "dependabot[bot]" has no other public repositories, common for burner accounts used in scams.+2

warningHardcoded secret/credentialAPI keys, passwords, or tokens hardcoded in source code. Should be in environment variables.src/components/ui/BidiInterpolatedText.tsx


export const BIDI_VALUE_TOKEN = "__OPENWHISPR_BIDI_VALUE__";

interface BidiInterpolatedTextProps {

warningHardcoded secret/credentialAPI keys, passwords, or tokens hardcoded in source code. Should be in environment variables.src/config/inferenceScopes.ts

      remoteUrl: "dictationAgentRemoteUrl",
      customApiKey: "dictationAgentCustomApiKey",
      disableThinking: "dictationAgentDisableThinking",
      reasoningEffort: "dictationAgentReasoningEff...

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

2551 files scanned @ fef65ff | 10/22/2026 | heuristic scan — always review manually

risk by category

code execution15

network & exfiltration4

file system access4

obfuscation3

supply chain8

owasp / injection6

telemetry

files 2551/3168rules hit 13engine v7commit fef65ff

github

OpenWhispr/openwhispr

Voice-to-text dictation app with local (Nvidia Parakeet/Whisper) and cloud models (BYOK). Privacy-first and available cross-platform.

JavaScript

9763

1245

497d

3168 files

2551 scanned(81%)

fef65ff

architecture░▒▓

entry (3) flagged (6) pkg (340)

740 nodes · 2248 edgesscroll to zoom · click node to jump to finding