github.com / Rayos-Org

Rayos-Org/mobile-app

TypeScript·110 files·commit 1023d8b·scanned 16d ago·cached ✓

22/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

scored by engine v7: rules have changed since, rescan for the current result

verdict accurate?

No stars or forks

No community activity

Research / educational context

threat-state: lowlive

FINDINGS ░▒▓

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningSeed phrase / private key harvesting UICollects seed phrase, private key, or mnemonic from the user via input/textarea/clipboard/prompt. Wallet drainers and fake wallet apps use this to steal funds.app/(onboarding)/create.tsx

            <Text tone="muted">
              Passkeys secure your wallet. No seed phrases, no passwords — nothing to write down.
            </Text>
            <Input

infoNative addon dependency"@react-native-masked-view/masked-view" includes native compiled code. Native addons can hide behavior that static JS analysis cannot see.package.json+2

infoNative addon dependency"react-native" includes native compiled code. Native addons can hide behavior that static JS analysis cannot see.package.json+2

infoNative addon dependency"react-native-gesture-handler" includes native compiled code. Native addons can hide behavior that static JS analysis cannot see.package.json+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

66 files scanned @ 1023d8b | 10/25/2026 | heuristic scan — always review manually

risk by category

code execution2

network & exfiltration0

file system access5

obfuscation0

supply chain15

owasp / injection0

telemetry

files 66/110rules hit 5engine v7commit 1023d8b

github

Rayos-Org/mobile-app

The native mobile experience, focused on the smoothest possible passkey UX (Face ID / Touch ID / Android biometric prompts feel far more native here than in a mobile browser

TypeScript

68d

110 files

66 scanned(60%)

1023d8b

architecture░▒▓

entry (0) flagged (1) pkg (65)

128 nodes · 384 edgesscroll to zoom · click node to jump to finding