live · scanning repos
Scanrepo
github.com
DANGER
malware detected
github.com / ViceVerse-cz

ViceVerse-cz/Serein

Rust·1349 files·commit 1b2f894·scanned 4h ago·cached ✓
70/100
DANGEROUS
Sensitive capability combinations reachable from entry points. Do not run without review.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?
46% file coverage
Partial architecture graph
threat-state: dangerouslive

FINDINGS ░▒▓

what this code does░▒▓

What happens when you open, install or run it, from the findings below.

  1. when runapps/desktop/src/updater_install.rs and 3 other files start system processes. apps/desktop/src/updater_install.rs, apps/desktop/src/video/fallback.rs, crates/platform/src/system_theme.rs, .github/release/check.mjs
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.apps/desktop/src/updater_install.rs
	{
		Command::new("/bin/kill")
			.args(["-0", &pid.to_string()])
			.stdout(Stdio::null())
+8
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.apps/desktop/src/video/fallback.rs
	// FFmpeg's smaller soft ceiling leaves room for the final MP4 sample tables.
	let mut child = Command::new("/bin/sh")
		.args(["-c", "ulimit -f 131072 || exit 1; exec \"$@\"", "serein-video", execut...
+8
warningVM code executionvm.runInNewContext or similar can execute arbitrary code in a sandboxed context that may be escaped.crates/platform/src/captcha.test.cjs
  const config = {capability: "random-capability:", sitekey: "service-sitekey", rqdata: 'quoted"data', dark: true, invisible};
  vm.runInNewContext(template.replace("__SEREIN_CAPTCHA_CONFIG__", JSON.s...
+4
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.crates/platform/src/system_theme.rs
		bounded_output(
			std::process::Command::new("gsettings").args([
				"get",
				"org.gnome.desktop.interface",
+8
criticalchild_process / exec usageExecuting shell commands can be used to download and run malware, exfiltrate data, or modify system files..github/release/check.mjs
  for (const step of job.steps ?? []) {
    if (step.run && step.shell !== 'pwsh') execFileSync('bash', ['-n'], { input: step.run });
  }
}
+8
warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.packaging/repositories/test_build.py
        self.assertTrue(setup_sh.is_file())
        res = subprocess.run(["sh", "-n", str(setup_sh)], capture_output=True, text=True)
        self.assertEqual(res.returncode, 0, res.stderr)
        co...
+4
infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.apps/desktop/src/connection.rs+4
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.crates/discord-voice/src/transport.rs+4
infoSuspicious file in repoExecutable file (sample-process.ps1) in repositorydocs/pr-evidence/channel-message-pills/sample-process.ps1+2
infoSuspicious file in repoExecutable file (install-notifications.ps1) in repositorypackaging/windows/install-notifications.ps1+2
infoSuspicious file in repoExecutable file (setup.ps1) in repositorypackaging/windows/setup.ps1+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

617 files scanned @ 1b2f894 | 10/30/2026 | heuristic scan — always review manually

risk by category
code execution25
network & exfiltration0
file system access0
obfuscation8
supply chain8
owasp / injection0
telemetry
files 617/1349rules hit 12engine v10commit 1b2f894

github

ViceVerse-cz/Serein

Tiny, Performant & 100% Native client for Discord made in Rust

Rust
899
69
51d
1349 files
617 scanned(46%)
1b2f894

network indicators░▒▓

Hosts this code names or would connect to. Top 50 of 391, decoded and call-site destinations first. Informational, not scored.

architecture░▒▓

entry (0) flagged (9) pkg (248)
648 nodes · 898 edgesscroll to zoom · click node to jump to finding
⚠️ DANGEROUS (70/100) — ViceVerse-cz/Serein — ScanRepo