DANGER
malware detected
github.com / QuixiAI
QuixiAI/ QuixiDesk
HTML·4827 files·commit 932d288·scanned 1d ago·cached ✓
100/100
MALICIOUS
Matches known-malicious patterns. Do not clone or install.
This repository contains patterns associated with malware. Do NOT run this code.
verdict accurate?
Created 1 days ago
Created in the last 7 days
Partial architecture graph
threat-state: maliciouslive
FINDINGS ░▒▓
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.bins/quixi-ssh-askpass/src/main.rs
);
if let Ok(out) = Command::new("/usr/bin/osascript").arg("-e").arg(script).output() {
if out.status.success() {
print!("{}", String::from_utf8_lossy(&out....+8warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.crates/quixi-app/src/main.rs
unsafe {
let _pool = NSAutoreleasePool::new(nil);
let app = NSApp();+3criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.crates/quixi-engine/src/lib.rs
let mut out = Vec::new();
if let Ok(res) = Command::new("xcrun")
.args(["simctl", "list", "devices", "--json"])
.output()+8criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.crates/quixi-engine/src/providers.rs
if open_browser && std::env::var("QUIXI_E2E_TEST").is_err() {
let _ = std::process::Command::new("open")
.arg(&verification_url)
.sp...+8warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.crates/quixi-platform/src/lib.rs
}
let rc = unsafe { clonefile(c_src.as_ptr(), c_dst.as_ptr(), 0) };
if rc == 0 {
return Ok(());+3warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.crates/quixi-engine/src/providers.rs
name: "OpenAI".to_string(),
subtitle: "Sign in with ChatGPT Plus/Pro subscription (Codex OAuth) or use an OpenAI Platform API key".to_string(),
badge: "...+5warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.resources/ion-dist/assets/v1/c11959232-TLc_9Vpx.js
const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/v1/shared-frame-CegduNQ2.css","assets/v1/shared-styles-D_GJawPO.css"])))=>i.map(i=>d[i]);
import{n as e,r as t,t as n}from"./preload-he...+5warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.resources/ion-dist/assets/v1/c3d91e0d6-DXXlSIxY.js
import{Bs as e,Ns as t,Ps as n}from"./shared-52-uHFNjl7C.js";import{Ut as r}from"./shared-3-BCEbd8Fv.js";var i={rate_limit:{outcome:"failure",error_type:"user_error",error_code:"usage_limit_reached"},...+5warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.resources/ion-dist/assets/v1/c3e34355f-ChC9vKYq.js
import{Co as e,Ha as t,Ia as n,Ua as r,Va as i,Ya as a,bo as o,fo as s,go as c,ho as l,so as u,to as d,wo as f}from"./vendor-frame-CnSY1sxv.js";import{$f as J2,Eu as p,Id as m,Jf as I3,Jo as h,Kf as I...+5warningClipboard read accessnavigator.clipboard.readText() reads the user's clipboard. In a wallet/crypto context this is often used to steal copied seed phrases or private keys.resources/ion-dist/assets/v1/c4517f799-DhULzHGF.js
`?r:n;return i<0?0:i+1}function Z(e,t){let n=e.indexOf(`
`,t),r=e.indexOf("\r",t);return r<0?n<0?e.length:n:n<0?r:Math.min(n,r)}var Ct={grapheme:[J,Y],word:[yt,bt],line:[X,Z]};function wt(e,t,n){let r...+4warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.resources/artifact-libs/npm_gridjs@5.0.2_dist_gridjs.umd.js+4
infoMinified code in source directoryMinified/obfuscated code in source directories (not dist/) makes code review impossible.resources/artifact-libs/npm_gridjs@5.0.2_dist_gridjs.umd.js+3
infoMinified code in source directoryMinified/obfuscated code in source directories (not dist/) makes code review impossible.resources/ion-dist/_frame-rt/_runtime/_comments.AKhddNYY.js+3
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.resources/ion-dist/_frame-rt/_runtime/_ldx.B4FSryPi.js+4
infoMinified code in source directoryMinified/obfuscated code in source directories (not dist/) makes code review impossible.resources/ion-dist/_frame-rt/_runtime/_ldx.B4FSryPi.js+3
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.resources/ion-dist/_frame-rt/_runtime/_ldx_cold.931917e10307b521.js+4
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order..agents/skills/visualize/assets/calendar.js+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.resources/artifact-libs/npm_gridjs@5.0.2_dist_gridjs.umd.js+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.resources/ion-dist/_frame-rt/_runtime/_comments.AKhddNYY.js+3
warningHigh-entropy string literalsFound 14 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.resources/ion-dist/_frame-rt/_runtime/artifact.BBvTDtAn.js+3
warningHigh-entropy string literalsFound 6 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.resources/ion-dist/assets/rumEncoder.worker-BDa_5gD7.js+3
warningHigh-entropy string literalsFound 20 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.resources/ion-dist/assets/v1/c0273df7e-BcRoghdw.js+3
warningLarge base64-encoded blobA 20000-character base64 blob was found. May hide a remote payload or encoded executable code.resources/ion-dist/assets/v1/c4bf86422-2VuMneI6.js
CithbnRocm9waWMvY2xpbnQvYXBpL3YxYWxwaGEvY2xpbnRfYXBpLnByb3Rv...+3
warningLarge base64-encoded blobA 1976-character base64 blob was found. May hide a remote payload or encoded executable code.resources/ion-dist/assets/v1/c65cc5e69-BIWNQ3o8.js
Ch5nb29nbGUvcnBjL2Vycm9yX2RldGFpbHMucHJvdG8SCmdvb2dsZS5ycGMi...+3
warningLarge base64-encoded blobA 2000-character base64 blob was found. May hide a remote payload or encoded executable code.resources/ion-dist/assets/v1/c66816193-BPHYnRLf.js
CjthbnRocm9waWMvY2xhdWRlYWlfY29kZS9hcGkvdjFhbHBoYS9jbGF1ZGVh...+3
infoSuspicious file in repoVery large source file (3489KB) — could contain obfuscated payloadresources/artifact-libs/npm_mermaid@11.17.2_dist_mermaid.min.js+2
infoSuspicious file in repoVery large source file (3489KB) — could contain obfuscated payloadresources/ion-dist/_frame-rt/_runtime/mermaid-11.17.2.min.js+2
infoSuspicious file in repoVery large source file (1540KB) — could contain obfuscated payloadresources/ion-dist/assets/highlightWorker-DC5uhXj0.js+2
warningHardcoded secret/credentialAPI keys, passwords, or tokens hardcoded in source code. Should be in environment variables.resources/ion-dist/assets/v1/c05b6b4f3-CRI8Bz3v.js
import{A as e,a as t,b as n,k as r,q as i,u as a,w as o,y as s}from"./vendor-zod-fszujTq6.js";import{n as c}from"./preload-helper-D0dM6GpB.js";import{Co as l,Ha as u,bo as d,ho as f,wo as p}from"./ven...+3warningHardcoded secret/credentialAPI keys, passwords, or tokens hardcoded in source code. Should be in environment variables.resources/ion-dist/assets/v1/c07c94932-WjZFrmIj.js
import{$f as J2,Qf as J1,Zf as J0,ap as K0,ip as J9,op as K1,sp as K2}from"./shared-frame-6jtSkIit.js";import{Kt as e,ht as t}from"./shared-0-DDOOdL6P.js";import{k as n,p as r,s as i}from"./vendor-que...+3warningHardcoded secret/credentialAPI keys, passwords, or tokens hardcoded in source code. Should be in environment variables.resources/ion-dist/assets/v1/c0f290978-C_tnJZwS.js
import{Ba as e,Co as t,Ha as n,Ia as r,To as i,Ua as a,Va as o,Ya as s,fo as c,go as l,ho as u,io as d,no as f,so as p,to as m,wo as h}from"./vendor-frame-CnSY1sxv.js";import{$f as J2,Id as g,Kf as I1...+3Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.
2921 files scanned @ 932d288 | 10/27/2026 | heuristic scan — always review manually
risk by category
code execution25
network & exfiltration5
file system access20
obfuscation15
supply chain15
owasp / injection9
telemetry
files 2921/4827rules hit 32engine v7commit 932d288
github
QuixiAI/QuixiDesk
94
23
3d
4827 files
2921 scanned(61%)
932d288
architecture░▒▓
entry (0) flagged (2035) pkg (38)
2087 nodes · 544 edgesscroll to zoom · click node to jump to finding