azalea-rs/azalea

Rust·732 files·commit 0d38e0d·scanned 2d ago·cached ✓

70/100

DANGEROUS

Sensitive capability combinations reachable from entry points. Do not run without review.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?

Partial architecture graph

threat-state: dangerouslive

FINDINGS ░▒▓

warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.azalea-block/azalea-block-macros/src/lib.rs

                // we just checked that the highest one must be valid
                unsafe { BlockKind::from_u32(TABLE[self.id() as usize]).unwrap_unchecked() }
            }
        }

        // is_valid_state before being constructed.
        unsafe { assert_unchecked(Self::is_valid_state(self.id)) };

        self.id

                match kind {
                    $( EnchantmentEffectComponentKind::$x => { unsafe { ManuallyDrop::drop(&mut self.$x) } }, )*
                }
            }

criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.azalea/build.rs

    // Run `rustc -V` to check the toolchain version
    let rustc_command = Command::new(&rustc_path).arg("-V").output().unwrap();

    if rustc_command.status.success() {

warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.codegen/lib/code/utils.py

def fmt():
    os.system(f"cd {get_dir_location('..')} && cargo fmt")

        print("\033[92mDownloading azalea-burger...\033[m")
        os.system(
            f"cd {get_dir_location('__cache__')} && git clone https://github.com/azalea-rs/azalea-burger && cd azalea-bur...

    get_server_jar(version_id)
    os.system(
        f'cd {get_dir_location("__cache__")} && java -DbundlerMainClass=net.minecraft.data.Main -jar {get_dir_location(f"__cache__/server-{version_id}.jar...

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.azalea-auth/src/auth.rs

    pub items: Vec<GameOwnershipItem>,
    pub signature: String,
    #[serde(rename = "keyId")]
    pub key_id: String,

use chrono::{DateTime, Utc};
use rsa::{RsaPrivateKey, pkcs8::DecodePrivateKey};
use serde::Deserialize;
use thiserror::Error;

    }
    /// Override the chat signing certificates for this account.
    ///
    /// You can get the certificates needed for this from

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.azalea-protocol/src/packets/game/c_player_info_update.rs+4

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.azalea-protocol/src/packets/game/c_system_chat.rs+4

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.azalea-protocol/src/packets/game/c_tab_list.rs+4

infoSuspicious file in repoVery large source file (507KB) — could contain obfuscated payloadazalea-language/src/en_us.json+2

infoSuspicious file in repoVery large source file (1145KB) — could contain obfuscated payloadazalea-physics/src/collision/blocks.rs+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

658 files scanned @ 0d38e0d | 10/26/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration20

file system access0

obfuscation15

supply chain4

owasp / injection0

telemetry

files 658/732rules hit 16engine v7commit 0d38e0d

github

azalea-rs/azalea

A collection of Rust crates for making Minecraft bots, clients, and tools.

Rust

801

124

1789d

732 files

658 scanned(90%)

0d38e0d

architecture░▒▓

entry (0) flagged (23) pkg (185)

585 nodes · 1095 edgesscroll to zoom · click node to jump to finding