github.com / OriginQ

OriginQ/QPanda-2

C++·1818 files·commit c85615a·scanned 1d ago·cached ✓

25/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 25 — 1,205 stars — findings likely legitimate code patterns

verdict accurate?

7% file coverage

threat-state: lowlive

FINDINGS ░▒▓

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.pyQPanda/cancer_classifier.py

            print("i:",i)
            loss = eval(cost_function,True)
            print(loss)
            back(exp,grad,leaf_set)

criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.pyQPanda/cancer_classifier.py

            print("i:",i)
            loss = eval(cost_function,True)
            print(loss)
            back(exp,grad,leaf_set)

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.pyQPanda/noisyqaoa.py

    for i in range(iterations):
        loss=eval(loss1,True)
        with open(result_fname, 'a+') as fp:
            # loss = eval(loss1,True)

criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.pyQPanda/noisyqaoa.py

    for i in range(iterations):
        loss=eval(loss1,True)
        with open(result_fname, 'a+') as fp:
            # loss = eval(loss1,True)

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.pyQPanda/pyqpanda/Algorithm/VariationalQuantumEigensolver/vqe.py

        data=term.split(' ',1)        
        tuplelist[data[1][1:-1]]=eval(data[0])

    operator=PauliOperator(tuplelist)

criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.pyQPanda/pyqpanda/Algorithm/VariationalQuantumEigensolver/vqe.py

        data=term.split(' ',1)        
        tuplelist[data[1][1:-1]]=eval(data[0])

    operator=PauliOperator(tuplelist)

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningHardcoded IP address in network callFetching data from hardcoded IP addresses instead of domain names is suspicious and may indicate C2 communication.pyQPanda/pyqpanda/Hamiltonian/chemistry_client.py

                hamiltonian_type='pauli',
                url='http://117.71.57.182:2222'
):    
    """

warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.pyQPanda/pyqpanda/OriginService/PilotOSMachine.py+3

warningLarge base64-encoded blobA 128-character base64 blob was found. May hide a remote payload or encoded executable code.pyQPanda/pyqpanda/backends/IBM/IBMQconfig.py

49000a0a22dd2d69bf5c5f27353ee8538c6c4ebd666b7baadab86f154c23...

warningLarge hex-encoded blobA 128-character hex blob was found. Often used to hide shellcode or C2 addresses.pyQPanda/pyqpanda/backends/IBM/IBMQconfig.py

49000a0a22dd2d69bf5c5f27353ee8538c6c4ebd666b7baadab86f154c23...

infoAuthor has no other public repositoriesGitHub user "wangjing" has no other public repositories, common for burner accounts used in scams.+2

warningHardcoded secret/credentialAPI keys, passwords, or tokens hardcoded in source code. Should be in environment variables.pyQPanda/pyqpanda/backends/IBM/IBMQconfig.py

APItoken = '49000a0a22dd2d69bf5c5f27353ee8538c6c4ebd666b7baadab86f154c2316b3777585677b43f00a7a5d9452aab309c31459c736a923535ce451bdd93cb1e3b1'

config = {

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

125 files scanned @ c85615a | 10/28/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration5

file system access0

obfuscation9

supply chain2

owasp / injection3

telemetry

files 125/1818rules hit 13engine v7commit c85615a

github

OriginQ/QPanda-2

QPanda 2 is an open source quantum computing framework developed by OriginQC that can be used to build, run, and optimize quantum algorithms.

C++

1205

114

3068d

1818 files

125 scanned(7%)

c85615a

architecture░▒▓

entry (0) flagged (8) pkg (112)

230 nodes · 429 edgesscroll to zoom · click node to jump to finding