live · scanning repos
Scanrepo
github.com
DANGER
malware detected
github.com / QuixiAI

QuixiAI/QuixiDesk

HTML·4827 files·commit 932d288·scanned 1d ago·cached ✓
100/100
MALICIOUS
Matches known-malicious patterns. Do not clone or install.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?
Created 1 days ago
Created in the last 7 days
Partial architecture graph
threat-state: maliciouslive

FINDINGS ░▒▓

criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.bins/quixi-ssh-askpass/src/main.rs
        );
        if let Ok(out) = Command::new("/usr/bin/osascript").arg("-e").arg(script).output() {
            if out.status.success() {
                print!("{}", String::from_utf8_lossy(&out....
+8
warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.crates/quixi-app/src/main.rs

    unsafe {
        let _pool = NSAutoreleasePool::new(nil);
        let app = NSApp();
+3
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.crates/quixi-engine/src/lib.rs
                let mut out = Vec::new();
                if let Ok(res) = Command::new("xcrun")
                    .args(["simctl", "list", "devices", "--json"])
                    .output()
+8
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.crates/quixi-engine/src/providers.rs
            if open_browser && std::env::var("QUIXI_E2E_TEST").is_err() {
                let _ = std::process::Command::new("open")
                    .arg(&verification_url)
                    .sp...
+8
warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.crates/quixi-platform/src/lib.rs
                }
                let rc = unsafe { clonefile(c_src.as_ptr(), c_dst.as_ptr(), 0) };
                if rc == 0 {
                    return Ok(());
+3
infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2
warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.crates/quixi-engine/src/providers.rs
                name: "OpenAI".to_string(),
                subtitle: "Sign in with ChatGPT Plus/Pro subscription (Codex OAuth) or use an OpenAI Platform API key".to_string(),
                badge: "...
+5
warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.resources/ion-dist/assets/v1/c11959232-TLc_9Vpx.js
const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/v1/shared-frame-CegduNQ2.css","assets/v1/shared-styles-D_GJawPO.css"])))=>i.map(i=>d[i]);
import{n as e,r as t,t as n}from"./preload-he...
+5
warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.resources/ion-dist/assets/v1/c3d91e0d6-DXXlSIxY.js
import{Bs as e,Ns as t,Ps as n}from"./shared-52-uHFNjl7C.js";import{Ut as r}from"./shared-3-BCEbd8Fv.js";var i={rate_limit:{outcome:"failure",error_type:"user_error",error_code:"usage_limit_reached"},...
+5
warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.resources/ion-dist/assets/v1/c3e34355f-ChC9vKYq.js
import{Co as e,Ha as t,Ia as n,Ua as r,Va as i,Ya as a,bo as o,fo as s,go as c,ho as l,so as u,to as d,wo as f}from"./vendor-frame-CnSY1sxv.js";import{$f as J2,Eu as p,Id as m,Jf as I3,Jo as h,Kf as I...
+5
warningClipboard read accessnavigator.clipboard.readText() reads the user's clipboard. In a wallet/crypto context this is often used to steal copied seed phrases or private keys.resources/ion-dist/assets/v1/c4517f799-DhULzHGF.js
`?r:n;return i<0?0:i+1}function Z(e,t){let n=e.indexOf(`
`,t),r=e.indexOf("\r",t);return r<0?n<0?e.length:n:n<0?r:Math.min(n,r)}var Ct={grapheme:[J,Y],word:[yt,bt],line:[X,Z]};function wt(e,t,n){let r...
+4
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.resources/artifact-libs/npm_gridjs@5.0.2_dist_gridjs.umd.js+4
infoMinified code in source directoryMinified/obfuscated code in source directories (not dist/) makes code review impossible.resources/artifact-libs/npm_gridjs@5.0.2_dist_gridjs.umd.js+3
infoMinified code in source directoryMinified/obfuscated code in source directories (not dist/) makes code review impossible.resources/ion-dist/_frame-rt/_runtime/_comments.AKhddNYY.js+3
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.resources/ion-dist/_frame-rt/_runtime/_ldx.B4FSryPi.js+4
infoMinified code in source directoryMinified/obfuscated code in source directories (not dist/) makes code review impossible.resources/ion-dist/_frame-rt/_runtime/_ldx.B4FSryPi.js+3
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.resources/ion-dist/_frame-rt/_runtime/_ldx_cold.931917e10307b521.js+4
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order..agents/skills/visualize/assets/calendar.js+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.resources/artifact-libs/npm_gridjs@5.0.2_dist_gridjs.umd.js+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.resources/ion-dist/_frame-rt/_runtime/_comments.AKhddNYY.js+3
warningHigh-entropy string literalsFound 14 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.resources/ion-dist/_frame-rt/_runtime/artifact.BBvTDtAn.js+3
warningHigh-entropy string literalsFound 6 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.resources/ion-dist/assets/rumEncoder.worker-BDa_5gD7.js+3
warningHigh-entropy string literalsFound 20 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.resources/ion-dist/assets/v1/c0273df7e-BcRoghdw.js+3
warningLarge base64-encoded blobA 20000-character base64 blob was found. May hide a remote payload or encoded executable code.resources/ion-dist/assets/v1/c4bf86422-2VuMneI6.js
CithbnRocm9waWMvY2xpbnQvYXBpL3YxYWxwaGEvY2xpbnRfYXBpLnByb3Rv...
+3
warningLarge base64-encoded blobA 1976-character base64 blob was found. May hide a remote payload or encoded executable code.resources/ion-dist/assets/v1/c65cc5e69-BIWNQ3o8.js
Ch5nb29nbGUvcnBjL2Vycm9yX2RldGFpbHMucHJvdG8SCmdvb2dsZS5ycGMi...
+3
warningLarge base64-encoded blobA 2000-character base64 blob was found. May hide a remote payload or encoded executable code.resources/ion-dist/assets/v1/c66816193-BPHYnRLf.js
CjthbnRocm9waWMvY2xhdWRlYWlfY29kZS9hcGkvdjFhbHBoYS9jbGF1ZGVh...
+3
infoSuspicious file in repoVery large source file (3489KB) — could contain obfuscated payloadresources/artifact-libs/npm_mermaid@11.17.2_dist_mermaid.min.js+2
infoSuspicious file in repoVery large source file (3489KB) — could contain obfuscated payloadresources/ion-dist/_frame-rt/_runtime/mermaid-11.17.2.min.js+2
infoSuspicious file in repoVery large source file (1540KB) — could contain obfuscated payloadresources/ion-dist/assets/highlightWorker-DC5uhXj0.js+2
warningHardcoded secret/credentialAPI keys, passwords, or tokens hardcoded in source code. Should be in environment variables.resources/ion-dist/assets/v1/c05b6b4f3-CRI8Bz3v.js
import{A as e,a as t,b as n,k as r,q as i,u as a,w as o,y as s}from"./vendor-zod-fszujTq6.js";import{n as c}from"./preload-helper-D0dM6GpB.js";import{Co as l,Ha as u,bo as d,ho as f,wo as p}from"./ven...
+3
warningHardcoded secret/credentialAPI keys, passwords, or tokens hardcoded in source code. Should be in environment variables.resources/ion-dist/assets/v1/c07c94932-WjZFrmIj.js
import{$f as J2,Qf as J1,Zf as J0,ap as K0,ip as J9,op as K1,sp as K2}from"./shared-frame-6jtSkIit.js";import{Kt as e,ht as t}from"./shared-0-DDOOdL6P.js";import{k as n,p as r,s as i}from"./vendor-que...
+3
warningHardcoded secret/credentialAPI keys, passwords, or tokens hardcoded in source code. Should be in environment variables.resources/ion-dist/assets/v1/c0f290978-C_tnJZwS.js
import{Ba as e,Co as t,Ha as n,Ia as r,To as i,Ua as a,Va as o,Ya as s,fo as c,go as l,ho as u,io as d,no as f,so as p,to as m,wo as h}from"./vendor-frame-CnSY1sxv.js";import{$f as J2,Id as g,Kf as I1...
+3

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

2921 files scanned @ 932d288 | 10/27/2026 | heuristic scan — always review manually

risk by category
code execution25
network & exfiltration5
file system access20
obfuscation15
supply chain15
owasp / injection9
telemetry
files 2921/4827rules hit 32engine v7commit 932d288

github

QuixiAI/QuixiDesk

HTML
94
23
3d
4827 files
2921 scanned(61%)
932d288

architecture░▒▓

entry (0) flagged (2035) pkg (38)
2087 nodes · 544 edgesscroll to zoom · click node to jump to finding
⚠️ MALICIOUS (100/100) — QuixiAI/QuixiDesk — ScanRepo