github.com / QuivrHQ

QuivrHQ/quivr

Go·2657 files·commit 1f72133·scanned 4d ago·cached ✓

15/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 15 — 39,603+ stars — findings likely false positives

verdict accurate?

39,603 stars

Partial architecture graph

threat-state: lowlive

FINDINGS ░▒▓

criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.scripts/eval/test_oss_modal.py

        namespace = {'__name__': 'oss_modal', '__file__': '/root/oss_modal.py'}
        exec(compile(source, namespace['__file__'], 'exec'), namespace)

        import oss_modal

warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.scripts/guides.py

    try:
        done = subprocess.run(['bash', '-eo', 'pipefail', '-c', block.command], cwd=cwd, capture_output=True, text=True,
                              timeout=COMMAND_TIMEOUT, env={**env, **{...

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.scripts/test_ci_select.py

                source = re.sub(r'\b(?:github|inputs|needs)\.[\w.-]+', reference, match.group(1))
                return eval(source.replace('&&', ' and ').replace('||', ' or '), {'__builtins__': {}, ...

criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.scripts/test_ci_select.py

                source = re.sub(r'\b(?:github|inputs|needs)\.[\w.-]+', reference, match.group(1))
                return eval(source.replace('&&', ' and ').replace('||', ' or '), {'__builtins__': {}, ...

            def git(*args):
                return subprocess.check_output(['git', *args], cwd=root, text=True).strip()
            git('init', '-q')
            git('config', 'user.email', 'fixture@e...

            with self.subTest(script=script):
                result = subprocess.run([sys.executable, str(ROOT / script), '--help'],
                                        capture_output=True, text=...

criticalGo os/exec usageos/exec is used to run external commands. In malware it drops payloads, modifies the system, or opens shells.cmd/quivr/main_test.go

			}
			cmd := exec.Command(os.Args[0], "-test.run=^TestConfigurationRefusalDiagnostics$")
			// Keep inherited credentials and logging overrides out of the child.
			cmd.Env = []string{"QUIVR_TEST_ST...

criticalGo os/exec usageos/exec is used to run external commands. In malware it drops payloads, modifies the system, or opens shells.internal/online/search_test.go

	gobin := filepath.Join(runtime.GOROOT(), "bin", "go")
	out, err := exec.Command(gobin, "list", "-deps", "github.com/The-Vibe-Company/quivr/internal/online").Output()
	if err != nil {
		t.Fatal(err)

criticalGo os/exec usageos/exec is used to run external commands. In malware it drops payloads, modifies the system, or opens shells.internal/plugins/devhost/devhost.go

	}
	cmd := exec.Command(opts.Command[0], opts.Command[1:]...)
	cmd.Dir = opts.Dir
	for _, entry := range os.Environ() {

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningHardcoded IP address in network callFetching data from hardcoded IP addresses instead of domain names is suspicious and may indicate C2 communication.internal/app/delivery_config_test.go

	}
	for _, u := range []string{"http://127.0.0.1:9/h", "https://169.254.169.254/latest", "http://[::1]:8080/", "http://10.0.0.5/h", "http://localhost:8080/h", "http://[::ffff:127.0.0.1]/"} {
		err := ...

warningGo net/http with hardcoded IPHardcoded public IP addresses in HTTP clients are common in malware C2 configurations.internal/app/delivery_config_test.go

	}
	for _, u := range []string{"http://127.0.0.1:9/h", "https://169.254.169.254/latest", "http://[::1]:8080/", "http://10.0.0.5/h", "http://localhost:8080/h", "http://[::ffff:127.0.0.1]/"} {
		err := ...

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.internal/adapters/postgres/versions.go+4

infoSuspicious file in repoVery large source file (1145KB) — could contain obfuscated payloadclient/client.gen.go+2

infoSuspicious file in repoVery large source file (528KB) — could contain obfuscated payloadinternal/transport/generated/transport.gen.go+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

1878 files scanned @ 1f72133 | 10/25/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration9

file system access0

obfuscation4

supply chain4

owasp / injection0

telemetry

files 1878/2657rules hit 15engine v7commit 1f72133

github

QuivrHQ/quivr

An open-source engine that turns continuous content streams into search and monitoring. Durable ingestion, hybrid search, alerts, and plugins for formats, models and business rules.

39603

3733

1266d

2657 files

1878 scanned(71%)

1f72133

architecture░▒▓

entry (1) flagged (14) pkg (339)

739 nodes · 2812 edgesscroll to zoom · click node to jump to finding