github.com / amidaware

amidaware/tacticalrmm

Python·733 files·commit e56ebd3·scanned 3m ago·cached ✓

25/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 25 — 4,480 stars — findings likely legitimate code patterns

verdict accurate?

Partial architecture graph

threat-state: lowlive

FINDINGS ░▒▓

warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.api/tacticalrmm/accounts/management/commands/generate_barcode.py

        url = pyotp.totp.TOTP(code).provisioning_uri(username, issuer_name=domain)
        subprocess.run(f'qr "{url}"', shell=True)
        self.stdout.write(
            self.style.SUCCESS("Scan the...

        )
        subprocess.run(f'qr "{url}"', shell=True)
        self.stdout.write(
            self.style.WARNING("Scan the barcode above with your authenticator app")

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.api/tacticalrmm/agents/migrations/0042_alter_agent_time_zone.py+4

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.api/tacticalrmm/core/migrations/0029_alter_coresettings_default_time_zone.py+4

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.api/tacticalrmm/core/migrations/0050_schedule_coresettings_report_history_prune_days_and_more.py+4

warningHigh-entropy string literalsFound 6 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.api/tacticalrmm/agents/management/commands/fake_agents.py+3

warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.api/tacticalrmm/agents/models.py+3

warningLarge base64-encoded blobA 160-character base64 blob was found. May hide a remote payload or encoded executable code.api/tacticalrmm/tacticalrmm/settings.py

bd65e957a1e70c622d32523f61508400d6cd0937001a7ac12042227eba0b...

warningLarge hex-encoded blobA 160-character hex blob was found. Often used to hide shellcode or C2 addresses.api/tacticalrmm/tacticalrmm/settings.py

bd65e957a1e70c622d32523f61508400d6cd0937001a7ac12042227eba0b...

warningLarge base64-encoded blobA 160-character base64 blob was found. May hide a remote payload or encoded executable code.api/tacticalrmm/tacticalrmm/test.py

41410834b8bb4481446027f87d88ec6f119eb9aa97860366440b778540c7...

warningLarge hex-encoded blobA 160-character hex blob was found. Often used to hide shellcode or C2 addresses.api/tacticalrmm/tacticalrmm/test.py

41410834b8bb4481446027f87d88ec6f119eb9aa97860366440b778540c7...

infoSuspicious file in repoExecutable file (installer.ps1) in repositoryapi/tacticalrmm/core/installer.ps1+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

642 files scanned @ e56ebd3 | 9/25/2026 | heuristic scan — always review manually

risk by category

code execution10

network & exfiltration0

file system access0

obfuscation15

supply chain2

owasp / injection0

telemetry

files 642/733rules hit 13engine v6commit e56ebd3

github

amidaware/tacticalrmm

A remote monitoring & management tool, built with Django, Vue and Go.

Python

4480

667

2529d

733 files

642 scanned(88%)

e56ebd3

architecture░▒▓

entry (1) flagged (9) pkg (175)

575 nodes · 1350 edgesscroll to zoom · click node to jump to finding