live · scanning repos
Scanrepo
github.com
DANGER
malware detected
github.com / aadeshrao123

aadeshrao123/Focuser

Rust·260 files·commit c49a980·scanned 57m ago·cached ✓
80/100
MALICIOUS
Matches known-malicious patterns. Do not clone or install.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?
Desktop app detected
threat-state: maliciouslive

FINDINGS ░▒▓

warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.crates/focuser-common/src/appicon_windows.rs
        // initialised apartment. Already-initialised is not an error here.
        unsafe {
            let _ = CoInitializeEx(None, COINIT_APARTMENTTHREADED);
        }
+3
warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.crates/focuser-common/src/process.rs
        // path out; `entry` is sized per the Win32 contract before the walk.
        unsafe {
            let Ok(snapshot) = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0) else {
                ret...
+3
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.crates/focuser-common/src/process.rs
        // installs, whereas PowerShell's CIM cmdlets ship everywhere.
        let output = std::process::Command::new("powershell")
            .args([
                "-NoProfile",
+8
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.crates/focuser-native/src/main.rs
    // Use reg.exe to set the registry key (avoids winreg dependency)
    let output = Command::new("reg")
        .args([
            "add",
+8
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.crates/focuser-ui/src/autostart.rs
    fn schtasks(args: &[&str]) -> Option<std::process::Output> {
        Command::new("schtasks")
            .args(args)
            .creation_flags(CREATE_NO_WINDOW)
+8
warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.crates/focuser-ui/src/foreground_watcher.rs
        let exe_name = file_name(&path).to_ascii_lowercase();
        let is_self = unsafe { pid == GetCurrentProcessId() };
        Some(ForegroundSample { exe_name, is_self })
    }
+3
infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2
criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.crates/focuser-native/src/main.rs
    // Chrome
    let chrome_dir = format!("{home}/.config/google-chrome/NativeMessagingHosts");
    fs::create_dir_all(&chrome_dir)?;
    fs::write(
+10
criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.crates/focuser-ui/src/native.rs
                &local,
                "BraveSoftware",
                "Brave-Browser",
                "Application",
+10
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.crates/focuser-ui/gen/schemas/acl-manifests.json+4
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.crates/focuser-ui/gen/schemas/desktop-schema.json+4
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.crates/focuser-ui/gen/schemas/windows-schema.json+4
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.crates/focuser-ui/frontend/src/components/starter-lists.tsx+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.crates/focuser-ui/frontend/src/components/target-breakdown.tsx+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.crates/focuser-ui/frontend/src/routes/allowances.tsx+3
warningHigh-entropy string literalsFound 8 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.extension/components/BlockPage.tsx+3
warningHigh-entropy string literalsFound 8 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.extension/entrypoints/popup/App.tsx+3
warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.extension/entrypoints/welcome/Welcome.tsx+3
warningDependency runs install scripts"<root>/postinstall" executes code during installation. Malicious packages use this to drop payloads before the app even runs.package.json+3

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

182 files scanned @ c49a980 | 9/25/2026 | heuristic scan — always review manually

risk by category
code execution25
network & exfiltration0
file system access20
obfuscation15
supply chain3
owasp / injection0
telemetry
files 182/260rules hit 19engine v6commit c49a980

github

aadeshrao123/Focuser

Free open source website and application blocker built in Rust. Block distracting sites and apps, run Pomodoro focus sessions, set daily time allowances, and stay on task. A self hosted Cold Turkey alternative for Windows, macOS, and Linux with Chrome and Firefox extensions.

Rust
29
7
174d
260 files
182 scanned(70%)
c49a980

architecture░▒▓

entry (2) flagged (18) pkg (195)
350 nodes · 612 edgesscroll to zoom · click node to jump to finding