github.com / Soumyadipta2020

Soumyadipta2020/Logistic-Control-Tower

TypeScript·108 files·commit 7242211·scanned 3d ago·cached ✓

12/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

verdict accurate?

No stars or forks

threat-state: lowlive

FINDINGS ░▒▓

warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.app.py

    # Start backend
    backend_process = subprocess.Popen(
        [sys.executable, "-m", "uvicorn", "app.main:app", "--reload", "--host", "127.0.0.1", "--port", "8000"],
        cwd=backend_dir,

infoSuspicious file in repoVery large source file (6571KB) — could contain obfuscated payloadbackend/data/synthetic_snapshot.json+2

infoSuspicious file in repoExecutable file (start.ps1) in repositorystart.ps1+2

infoAuthor has no other public repositoriesGitHub user "dependabot[bot]" has no other public repositories, common for burner accounts used in scams.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

82 files scanned @ 7242211 | 10/26/2026 | heuristic scan — always review manually

risk by category

code execution4

network & exfiltration0

file system access0

obfuscation0

supply chain6

owasp / injection0

telemetry

files 82/108rules hit 4engine v7commit 7242211

github

Soumyadipta2020/Logistic-Control-Tower

TypeScript

64d

108 files

82 scanned(76%)

7242211

architecture░▒▓

entry (2) flagged (1) pkg (69)

147 nodes · 430 edgesscroll to zoom · click node to jump to finding