DANGER
malware detected
github.com / aadeshrao123
aadeshrao123/ Focuser
Rust·260 files·commit c49a980·scanned 57m ago·cached ✓
80/100
MALICIOUS
Matches known-malicious patterns. Do not clone or install.
This repository contains patterns associated with malware. Do NOT run this code.
verdict accurate?
Desktop app detected
threat-state: maliciouslive
FINDINGS ░▒▓
warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.crates/focuser-common/src/appicon_windows.rs
// initialised apartment. Already-initialised is not an error here.
unsafe {
let _ = CoInitializeEx(None, COINIT_APARTMENTTHREADED);
}+3warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.crates/focuser-common/src/process.rs
// path out; `entry` is sized per the Win32 contract before the walk.
unsafe {
let Ok(snapshot) = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0) else {
ret...+3criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.crates/focuser-common/src/process.rs
// installs, whereas PowerShell's CIM cmdlets ship everywhere.
let output = std::process::Command::new("powershell")
.args([
"-NoProfile",+8criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.crates/focuser-native/src/main.rs
// Use reg.exe to set the registry key (avoids winreg dependency)
let output = Command::new("reg")
.args([
"add",+8criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.crates/focuser-ui/src/autostart.rs
fn schtasks(args: &[&str]) -> Option<std::process::Output> {
Command::new("schtasks")
.args(args)
.creation_flags(CREATE_NO_WINDOW)+8warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.crates/focuser-ui/src/foreground_watcher.rs
let exe_name = file_name(&path).to_ascii_lowercase();
let is_self = unsafe { pid == GetCurrentProcessId() };
Some(ForegroundSample { exe_name, is_self })
}+3criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.crates/focuser-native/src/main.rs
// Chrome
let chrome_dir = format!("{home}/.config/google-chrome/NativeMessagingHosts");
fs::create_dir_all(&chrome_dir)?;
fs::write(+10criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.crates/focuser-ui/src/native.rs
&local,
"BraveSoftware",
"Brave-Browser",
"Application",+10warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.crates/focuser-ui/gen/schemas/acl-manifests.json+4
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.crates/focuser-ui/gen/schemas/desktop-schema.json+4
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.crates/focuser-ui/gen/schemas/windows-schema.json+4
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.crates/focuser-ui/frontend/src/components/starter-lists.tsx+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.crates/focuser-ui/frontend/src/components/target-breakdown.tsx+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.crates/focuser-ui/frontend/src/routes/allowances.tsx+3
warningHigh-entropy string literalsFound 8 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.extension/components/BlockPage.tsx+3
warningHigh-entropy string literalsFound 8 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.extension/entrypoints/popup/App.tsx+3
warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.extension/entrypoints/welcome/Welcome.tsx+3
warningDependency runs install scripts"<root>/postinstall" executes code during installation. Malicious packages use this to drop payloads before the app even runs.package.json+3
Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.
182 files scanned @ c49a980 | 9/25/2026 | heuristic scan — always review manually
risk by category
code execution25
network & exfiltration0
file system access20
obfuscation15
supply chain3
owasp / injection0
telemetry
files 182/260rules hit 19engine v6commit c49a980
github
aadeshrao123/Focuser
Free open source website and application blocker built in Rust. Block distracting sites and apps, run Pomodoro focus sessions, set daily time allowances, and stay on task. A self hosted Cold Turkey alternative for Windows, macOS, and Linux with Chrome and Firefox extensions.
29
7
174d
260 files
182 scanned(70%)
c49a980
architecture░▒▓
entry (2) flagged (18) pkg (195)
350 nodes · 612 edgesscroll to zoom · click node to jump to finding