live · scanning repos
Scanrepo
github.com
DANGER
malware detected
github.com / SupaStellar

SupaStellar/Cleanmeter

TypeScript·401 files·commit 93b33a5·scanned 2h ago·cached ✓
77/100
DANGEROUS
Sensitive capability combinations reachable from entry points. Do not run without review.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?
34% file coverage
Desktop app detected
threat-state: dangerouslive

FINDINGS ░▒▓

warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.tauri-app/src-tauri/src/commands.rs
    use windows::Win32::UI::WindowsAndMessaging::{GetForegroundWindow, GetWindowThreadProcessId};
    unsafe {
        let hwnd = GetForegroundWindow();
        if hwnd.0.is_null() {
+3
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.tauri-app/src-tauri/src/commands.rs
            for image in ["HardwareMonitor.exe", "presentmon.exe"] {
                let _ = std::process::Command::new("taskkill")
                    .args(["/f", "/im", image])
                    ...
+8
warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.tauri-app/src-tauri/src/lib.rs
    use windows::Win32::System::Threading::{GetCurrentProcess, OpenProcessToken};
    unsafe {
        let mut token = HANDLE::default();
        if OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, ...
+3
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.tauri-app/src-tauri/src/lib.rs
    const CREATE_NO_WINDOW: u32 = 0x08000000;
    std::process::Command::new("sc.exe")
        .args(["query", "PawnIO"])
        .creation_flags(CREATE_NO_WINDOW)
+8
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.tauri-app/src-tauri/src/tray.rs
                use std::os::windows::process::CommandExt;
                let _ = std::process::Command::new("taskkill")
                    .args(["/f", "/im", "HardwareMonitor.exe"])
              ...
+8
infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2
warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.tauri-app/src-tauri/src/commands.rs

        // Refused. Signal instead of forcing: three flashes of the taskbar button,
        // which then stop on their own.
        //
+5
warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.tauri-app/src/App.tsx+3
warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.tauri-app/src/app/components/Card.tsx+3
warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.tauri-app/src/app/components/Keycap.tsx+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.tauri-app/src/components/overlay/CpuSection.tsx+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.tauri-app/src/components/overlay/FpsSection.tsx+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.tauri-app/src/components/overlay/GpuSection.tsx+3
infoSuspicious file in repoExecutable file (gradlew.bat) in repositorygradlew.bat+2
infoSuspicious file in repoExecutable file (PawnIO_setup.exe) in repositorypawnio/PawnIO_setup.exe+2
infoSuspicious file in repoExecutable file (presentmon.exe) in repositorypresentmon/presentmon.exe+2
infoNative addon dependency"@storybook/addon-a11y" includes native compiled code. Native addons can hide behavior that static JS analysis cannot see.package.json+2
infoNative addon dependency"@storybook/addon-docs" includes native compiled code. Native addons can hide behavior that static JS analysis cannot see.package.json+2
infoNative addon dependency"@storybook/addon-onboarding" includes native compiled code. Native addons can hide behavior that static JS analysis cannot see.package.json+2
infoAuthor has no other public repositoriesGitHub user "dependabot[bot]" has no other public repositories, common for burner accounts used in scams.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

138 files scanned @ 93b33a5 | 9/25/2026 | heuristic scan — always review manually

risk by category
code execution25
network & exfiltration5
file system access0
obfuscation15
supply chain15
owasp / injection0
telemetry
files 138/401rules hit 20engine v6commit 93b33a5

github

SupaStellar/Cleanmeter

CleanMeter (private fork — see CleanMeter-archive for upstream history)

TypeScript
43
8
141d
401 files
138 scanned(34%)
93b33a5

architecture░▒▓

entry (2) flagged (27) pkg (105)
232 nodes · 432 edgesscroll to zoom · click node to jump to finding