github.com / Unitech

Unitech/pm2

JavaScript·998 files·commit 6fcb92a·scanned 5d ago·cached ✓

15/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 15 — 43,312+ stars — findings likely false positives

verdict accurate?

43,312 stars

Partial architecture graph

CLI tool detected

threat-state: lowlive

FINDINGS ░▒▓

criticalchild_process / exec usageExecuting shell commands can be used to download and run malware, exfiltrate data, or modify system files.lib/API/Modules/TAR.js

var os = require('os');
var spawn = require('child_process').spawn;
var exec = require('child_process').exec;
var execSync = require('child_process').execSync;

warningVM code executionvm.runInNewContext or similar can execute arbitrary code in a sandboxed context that may be escaped.lib/Common.js


    return vm.runInThisContext(code, sandbox, {
      filename: path.resolve(filename),
      displayErrors: false,

criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.modules/blessed/lib/tput.js

    if (this.options.stringify && code.indexOf('return ') === 0) {
      return new Function('', code)();
    }
    return this.printf || ~code.indexOf('sprintf(')

criticalRemote script piped into a shellA shell script downloads remote content and executes it directly (e.g. `curl … | bash`). The payload is never stored or reviewable and can change server-side — a classic malware/backdoor install pattern.packager/setup.deb.sh

{
    echo "Checking for curl..."
    if command -v curl > /dev/null; then
        echo "Detected curl..."

+10

{
    echo "Checking for curl..."
    if command -v curl > /dev/null; then
        echo "Detected curl..."

+10

criticalSuspicious code is reachable from an entry pointFlagged files are imported by the application's entry path: lib/API/Modules/TAR.js, lib/Common.js, modules/blessed/lib/program.js. This means the suspicious code can execute when the app runs.+8

warningCluster of suspicious files reachable from entry4 flagged files form a connected cluster that is reachable from an entry point, suggesting coordinated malicious behavior rather than isolated false positives.+5

warningHigh-entropy string literalsFound 6 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.modules/blessed/lib/program.js+3

infoSuspicious file in repoExecutable file (pm2.ps1) in repositorybin/pm2.ps1+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

826 files scanned @ 6fcb92a | 10/22/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration0

file system access0

obfuscation3

supply chain2

owasp / injection0

telemetry

files 826/998rules hit 9engine v7commit 6fcb92a

github

Unitech/pm2

Node.js/Typescript/Bun Production Process Manager with a built-in Load Balancer.

JavaScript

43312

2733

4908d

998 files

826 scanned(83%)

6fcb92a

architecture░▒▓

entry (1) flagged (4) pkg (75)

475 nodes · 873 edgesscroll to zoom · click node to jump to finding