github.com / ashenjay

ashenjay/hifiplayer

Rust·135 files·commit 6b77165·scanned 3d ago·cached ✓

33/100

SUSPICIOUS

Obfuscation or dynamic code paths detected. Intent unclear — review before running anything.

verdict accurate?

Created 2 days ago

No stars or forks

Created in the last 7 days

No community activity

Desktop app detected

threat-state: suspiciouslive

FINDINGS ░▒▓

warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.app/src-tauri/src/taskbar.rs

    let addr = hwnd.0 as isize;
    let _ = app.run_on_main_thread(move || unsafe { setup(HWND(addr as _)) });

    // Swap the play/pause icon when the state changes.

    let mut out = Vec::new();
    unsafe {
        let mut root = 0isize;
        if RegOpenKeyExW(HKEY_LOCAL_MACHINE, wide("SOFTWARE\\ASIO").as_ptr(), 0, KEY_READ, &mut root) != 0 {

    fn take(out: Blob) -> Vec<u8> {
        let v = unsafe { std::slice::from_raw_parts(out.data, out.len as usize) }.to_vec();
        unsafe { LocalFree(out.data.cast()) };
        v

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.app/src-tauri/src/dlna.rs

        assert_eq!(it.title, "Pushed Tone");
        println!("  signal path: {}", st.signal_path.as_ref().map(|p| p.output.as_str()).unwrap_or(""));
        assert!(st.signal_path.as_ref().is_some_an...


    /// A signed, short-lived stream URL for a track.
    pub fn resolve(&self, id: &str, quality: StreamQuality) -> Result<ResolvedStream> {
        let secret = Secrets::get("qobuz.app_secret").con...

infoSuspicious file in repoExecutable file (bump-version.ps1) in repositoryscripts/bump-version.ps1+2

infoSuspicious file in repoExecutable file (make-artwork.ps1) in repositoryscripts/make-artwork.ps1+2

infoSuspicious file in repoExecutable file (third-party-notices.ps1) in repositoryscripts/third-party-notices.ps1+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

94 files scanned @ 6b77165 | 10/26/2026 | heuristic scan — always review manually

risk by category

code execution11

network & exfiltration10

file system access0

obfuscation0

supply chain6

owasp / injection0

telemetry

files 94/135rules hit 9engine v7commit 6b77165

github

ashenjay/hifiplayer

Bit-perfect music player for Windows: ASIO, WASAPI Exclusive, native DSD, gapless, music library and Spotify Connect.

Rust

135 files

94 scanned(70%)

6b77165

architecture░▒▓

entry (3) flagged (5) pkg (104)

190 nodes · 315 edgesscroll to zoom · click node to jump to finding