live · scanning repos
Scanrepo
github.com
DANGER
malware detected
github.com / auroraborealiscoin

auroraborealiscoin/auroraborealis

C·1770 files·commit 4ca68ea·scanned 1d ago·cached ✓
100/100
MALICIOUS
Matches known-malicious patterns. Do not clone or install.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?
Obfuscated code detected
Created 28 days ago
Crypto/Web3 project
Created 28 days ago
20% file coverage
threat-state: maliciouslive

FINDINGS ░▒▓

warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.contrib/devtools/github-merge.py
    try:
        return subprocess.check_output([GIT,'config','--get',option]).rstrip().decode('utf-8')
    except subprocess.CalledProcessError as e:
        return default
+4
warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.contrib/devtools/optimize-pngs.py
folders = ["src/qt/res/movies", "src/qt/res/icons", "share/pixmaps"]
basePath = subprocess.check_output([git, 'rev-parse', '--show-toplevel']).rstrip('\n')
totalSaveBytes = 0
noHashChange = True
+4
criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.test/functional/feature_versionbits_warning.py
WARN_UNKNOWN_RULES_ACTIVE = "unknown new rules activated (versionbit {})".format(VB_UNKNOWN_BIT)
VB_PATTERN = compile("^Warning.*versionbit")

class TestNode(NodeConnCB):
+7
infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2
criticalCryptocurrency wallet directory accessAccessing wallet directories to steal private keys, seed phrases, or wallet data.test/functional/wallet_bip44.py
        # But words are readable in a non-encrypted wallet
        with open(os.path.join(self.options.tmpdir+"/node0/regtest/", "wallet.dat"), 'rb') as f:
            assert_contains(MNEMONIC_0, str(...
+5
criticalCryptocurrency wallet directory accessAccessing wallet directories to steal private keys, seed phrases, or wallet data.test/functional/wallet_bip44_multilanguage.py
      
        with open(os.path.join(self.options.tmpdir+"/node1/regtest/", "wallet.dat"), 'rb') as f:
            assert_contains(mnemonic_1, str(f.read()))
+5
criticalCryptocurrency wallet directory accessAccessing wallet directories to steal private keys, seed phrases, or wallet data.test/functional/wallet_hd.py
        shutil.rmtree(os.path.join(tmpdir, "node1/regtest/chainstate"))
        shutil.copyfile(os.path.join(tmpdir, "hd.bak"), os.path.join(tmpdir, "node1/regtest/wallet.dat"))
        self.start_nod...
+5
warningHex-encoded string sequencesLong hex-encoded strings are commonly used to hide malicious code from code review.contrib/macdeploy/custom_dsstore.py
    'viewOptionsVersion': 1,
    'backgroundImageAlias': b'\x00\x00\x00\x00\x02\x1e\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\...
+5
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.contrib/macdeploy/custom_dsstore.py+4
criticalString-array obfuscation detectedCode resolves its string literals through a rotating string-array decoder — many `name(0xNNN)` index calls that reconstruct hidden strings at runtime. This is the structural signature of javascript-obfuscator regardless of the variable-naming scheme, so it fires even when mangled identifiers (e.g. `j5`, `jM`) are used to evade _0x-based detection. Commonly used to hide malware from code review.test/functional/test_framework/script.py
# push value
OP_0 = CScriptOp(0x00)
OP_FALSE = OP_0
OP_PUSHDATA1 = CScriptOp(0x4c)
+18
warningHex-encoded string sequencesLong hex-encoded strings are commonly used to hide malicious code from code review.test/functional/test_framework/script.py
    """
    hash_one = b'\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'

    if in_idx >= len(tx_to.vin):
+5
warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.src/qt/locale/raven_ca.ts+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.src/qt/locale/raven_ca.ts+3
warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.src/qt/locale/raven_ca@valencia.ts+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.src/qt/locale/raven_ca@valencia.ts+3
warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.src/qt/locale/raven_ca_ES.ts+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.src/qt/locale/raven_ca_ES.ts+3
warningLarge hex-encoded blobA 130-character hex blob was found. Often used to hide shellcode or C2 addresses.test/functional/feature_segwit.py
04A47F2CBCEFFA7B9BCDA184E7D5668D3DA6F9079AD41E422FA5FD7B2D45...
+3
warningLarge base64-encoded blobA 424-character base64 blob was found. May hide a remote payload or encoded executable code.test/functional/rpc_decodescript.py
01000000015ded05872fdbda629c7d3d02b194763ce3b9b1535ea884e3c8...
+3
warningLarge hex-encoded blobA 746-character hex blob was found. Often used to hide shellcode or C2 addresses.test/functional/rpc_decodescript.py
01000000018d1f5635abd06e2c7e2ddf58dc85b3de111e4ad6e0ab51bb0d...
+3
warningLarge base64-encoded blobA 88-character base64 blob was found. May hide a remote payload or encoded executable code.test/functional/rpc_signmessage.py
H5vCbG+WhOeOPJ3jf6oux/1oSjkuIGZigCw4NW+A0/fSDlgdO4fMq0SWSfx7...
+3
warningLarge hex-encoded blobA 686-character hex blob was found. Often used to hide shellcode or C2 addresses.test/functional/rpc_signrawtransaction.py
01000000000102fff7f7881a8099afa6940d42d1e7f6362bec38171ea3ed...
+3

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

348 files scanned @ 4ca68ea | 9/14/2026 | heuristic scan — always review manually

risk by category
code execution17
network & exfiltration0
file system access20
obfuscation15
supply chain0
owasp / injection0
telemetry
files 348/1770rules hit 22engine v5commit 4ca68ea

github

auroraborealiscoin/auroraborealis

Aurora Borealis Coin Core - ABRS peer-to-peer blockchain and wallet

C
1
0
29d
1770 files
348 scanned(20%)
4ca68ea

architecture░▒▓

entry (0) flagged (51) pkg (82)
319 nodes · 589 edgesscroll to zoom · click node to jump to finding