github.com / WireGuard

WireGuard/wireguard-linux

C·67498 files·commit 2a73c9b·scanned 3d ago·cached ✓

25/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 25 — 2,027 stars — findings likely legitimate code patterns

partial scan: host truncated the file tree — some files were not enumerated

verdict accurate?

0% file coverage

Partial scan

threat-state: lowlive

FINDINGS ░▒▓

warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.drivers/android/binder/allocation.rs

        // in turn, the pages will be marked as in use.
        unsafe {
            self.process
                .pages

        // SAFETY: Reading `flags` from a task is always okay.
        if unsafe { ((*current.as_ptr()).flags & bindings::PF_KTHREAD) != 0 } {
            return Err(DeferredFdCloseError::TaskWorkUnav...

                // always be valid.
                unsafe { self.0.assume_init_ref() }
            }
        }

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.drivers/comedi/drivers/ni_routing/tools/convert_csv_to_c.py


  D0 = sorted(D0.items(), key=lambda i: eval(i[0], comedi_h.__dict__, Locals))

  for D0_sig, D1_D in D0:

criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.drivers/comedi/drivers/ni_routing/tools/convert_csv_to_c.py


  D0 = sorted(D0.items(), key=lambda i: eval(i[0], comedi_h.__dict__, Locals))

  for D0_sig, D1_D in D0:

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

infoAuthor has no other public repositoriesGitHub user "ovidiu-renesas" has no other public repositories, common for burner accounts used in scams.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

120 files scanned @ 2a73c9b | 10/25/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration0

file system access0

obfuscation0

supply chain2

owasp / injection0

telemetry

files 120/67498rules hit 7engine v7commit 2a73c9b

github

WireGuard/wireguard-linux

Mirror only. Official repository is at https://git.zx2c4.com/wireguard-linux

2027

308

2499d

67498 files

120 scanned(0%)

2a73c9b

architecture░▒▓

entry (0) flagged (18) pkg (71)

133 nodes · 136 edgesscroll to zoom · click node to jump to finding