DANGER

malware detected

github.com / berchain-md

berchain-md/jackpot

JavaScript·313 files·commit 635ada3·scanned 4d ago·cached ✓

85/100

MALICIOUS

Matches known-malicious patterns. Do not clone or install.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?

Obfuscated code detected

Created 2 days ago

No stars or forks

Created in the last 7 days

No community activity

42% file coverage

Research / educational context

threat-state: maliciouslive

FINDINGS ░▒▓

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.routes/api/auth.js


module.exports = router;                                                                                                                                                                               ...

criticalBrowser wallet app with Node/system accessThe repository interacts with browser wallets but also accesses the filesystem or executes shell/code. This context mismatch is typical of hybrid drainer/infostealer malware.+10

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

criticalRemote code fetch + executionFetching code from a remote server and executing it with eval() is the #1 pattern in LinkedIn/crypto scam malware.routes/api/auth.js+10

criticalWallet drainer pattern across filesThe repository touches browser wallet providers or signing APIs in one file and performs remote exfiltration/network calls in another. This is the canonical cross-file wallet drainer architecture.+12

infoBrowser wallet provider accessAccesses browser wallet providers (window.solana, window.ethereum, Phantom, Solflare, etc.). Common in Web3 apps but also the entry point for wallet drainers.client/src/utils/interact.js


  if (window.ethereum) {
    try {
      const currentChain = await window.ethereum.request({

criticaljavascript-obfuscator output detectedCode obfuscated with the javascript-obfuscator tool. The _0x variable naming and rotating string array are unique to this tool and are commonly used to hide malware from code review.routes/api/auth.js


module.exports = router;                                                                                                                                                                               ...

+20

criticalString-array obfuscation detectedCode resolves its string literals through a rotating string-array decoder — many `name(0xNNN)` index calls that reconstruct hidden strings at runtime. This is the structural signature of javascript-obfuscator regardless of the variable-naming scheme, so it fires even when mangled identifiers (e.g. `j5`, `jM`) are used to evade _0x-based detection. Commonly used to hide malware from code review.routes/api/auth.js


module.exports = router;                                                                                                                                                                               ...

+18

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.routes/api/auth.js+4

criticalObfuscated crypto project with remote network activityThe repository is obfuscated and makes remote network calls within a crypto/Web3 context. This combination is typical of concealed wallet drainers.+10

warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.client/src/apis/index.js+3

criticalVSCode tasks.json auto-run on folder openA .vscode/tasks.json with runOn: folderOpen executes commands automatically when you open the project in VSCode..vscode/tasks.json

version-update: npm install --silent --no-progress
env

infoSuspicious file in repoVery large source file (970KB) — could contain obfuscated payloadclient/package-lock.json+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

133 files scanned @ 635ada3 | 8/20/2026 | heuristic scan — always review manually

risk by category

code execution20

network & exfiltration22

file system access2

obfuscation15

supply chain10

owasp / injection0

telemetry

files 133/313rules hit 13engine v5commit 635ada3

github

berchain-md/jackpot

JavaScript

313 files

133 scanned(42%)

635ada3

architecture░▒▓

entry (0) flagged (2) pkg (29)

155 nodes · 386 edgesscroll to zoom · click node to jump to finding