github.com / Rayos-Org

Rayos-Org/mobile-app

TypeScript·110 files·commit 5fac81c·scanned 42m ago·cached ✓

40/100

SUSPICIOUS

Obfuscation or dynamic code paths detected. Intent unclear — review before running anything.

verdict accurate?

Created 21 days ago

No stars or forks

Created 21 days ago

No community activity

Research / educational context

threat-state: suspiciouslive

FINDINGS ░▒▓

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningSeed phrase / private key harvesting UICollects seed phrase, private key, or mnemonic from the user via input/textarea/clipboard/prompt. Wallet drainers and fake wallet apps use this to steal funds.app/(onboarding)/create.tsx

            <Text tone="muted">
              Passkeys secure your wallet. No seed phrases, no passwords — nothing to write down.
            </Text>
            <Input

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.app/(onboarding)/recover.tsx+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.app/recovery/[proposalId].tsx+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.jest.setup.ts+3

infoNative addon dependency"@react-native-masked-view/masked-view" includes native compiled code. Native addons can hide behavior that static JS analysis cannot see.package.json+2

infoNative addon dependency"react-native" includes native compiled code. Native addons can hide behavior that static JS analysis cannot see.package.json+2

infoNative addon dependency"react-native-gesture-handler" includes native compiled code. Native addons can hide behavior that static JS analysis cannot see.package.json+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

66 files scanned @ 5fac81c | 9/25/2026 | heuristic scan — always review manually

risk by category

code execution2

network & exfiltration0

file system access5

obfuscation12

supply chain15

owasp / injection0

telemetry

files 66/110rules hit 8engine v6commit 5fac81c

github

Rayos-Org/mobile-app

The native mobile experience, focused on the smoothest possible passkey UX (Face ID / Touch ID / Android biometric prompts feel far more native here than in a mobile browser

TypeScript

21d

110 files

66 scanned(60%)

5fac81c

architecture░▒▓

entry (0) flagged (5) pkg (65)

128 nodes · 384 edgesscroll to zoom · click node to jump to finding