live · scanning repos
Scanrepo
github.com
DANGER
malware detected
github.com / SysAdminDoc

SysAdminDoc/DeepPurge

C#·230 files·commit 7efdae8·scanned 2h ago·cached ✓
70/100
DANGEROUS
Sensitive capability combinations reachable from entry points. Do not run without review.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?
5% file coverage
threat-state: dangerouslive

FINDINGS ░▒▓

warningSuspicious Windows batch commandBatch file contains commands commonly used to download and execute remote payloads (powershell, certutil, bitsadmin, curl to pipe, etc.).BUILD.bat
:: Run the build script with proper execution policy
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%~dp0Build.ps1" -OpenOutput

echo.
+5
criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.src/DeepPurge.Core/Data/leftover-signatures.json
[
  {"name":"Google Chrome","aliases":["Chrome","Google Chrome"],"files":["%LocalAppData%\\Google\\Chrome","%AppData%\\Google\\Chrome","%ProgramData%\\Google\\Chrome","%ProgramFiles%\\Google\\Chrome"]...
+10
infoSuspicious file in repoExecutable file (BUILD.bat) in repositoryBUILD.bat+2
infoSuspicious file in repoExecutable file (Build.ps1) in repositoryBuild.ps1+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

12 files scanned @ 7efdae8 | 9/25/2026 | heuristic scan — always review manually

risk by category
code execution5
network & exfiltration0
file system access10
obfuscation0
supply chain4
owasp / injection0
telemetry
files 12/230rules hit 4engine v6commit 7efdae8

github

SysAdminDoc/DeepPurge

Safety-first Windows uninstaller and cleanup toolkit with recovery evidence, a portable GUI, and a scriptable CLI.

C#
18
1
226d
230 files
12 scanned(5%)
7efdae8

architecture░▒▓

No architecture graph available. This usually happens when the repo contains no scannable JS/TS/Python files or only a single file was analyzed.