github.com / bilawalsidhu

bilawalsidhu/gods-eye-view

JavaScript·1492 files·commit 818b654·scanned 17m ago·cached ✓

15/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 15 — 42,578+ stars — findings likely false positives

verdict accurate?

42,578 stars

Partial architecture graph

threat-state: lowlive

FINDINGS ░▒▓

criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.scripts/qa-draw-tool.mjs

        // eslint-disable-next-line no-new-func
        const belongsTo = new Function(`return (${belongsSource})`)();
        const viewer = window.__godsEyeView.viewer;
        const scene = viewer....

criticalchild_process / exec usageExecuting shell commands can be used to download and run malware, exfiltrate data, or modify system files.server/standalone/key-setup-hardening.mjs

        // hardening failure and refused every save on such machines.
        const aclRemoval = spawn('/bin/chmod', ['-N', filepath], {
          stdio: 'ignore',
        });

warningVM code executionvm.runInNewContext or similar can execute arbitrary code in a sandboxed context that may be escaped.src/data/detectionSonarAdmission.test.mjs

          };
          vm.runInNewContext(
            alphaBlock + bandAssignment + '; result = bracketAlpha;',
            state,

criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.src/data/firmsProxy.test.mjs

function createRefresh(fetchSource, filter = filterTrailing24h) {
  return new Function('SOURCES', 'fetchSource', 'filterTrailing24h', 'Date', 'console',
    `return (${refreshSource});`)(SOURCES, fet...

criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.src/mapSourceFocus.test.mjs

  document.defaultView = window;
  const methods = new Function('createHoverDisclosure', 'collapsePanelOnEscape', 'document', 'window', 'clearTimeout', 'performance', 'requestAnimationFrame',
    `ret...

warningVM code executionvm.runInNewContext or similar can execute arbitrary code in a sandboxed context that may be escaped.src/standalone/startupChrome.test.mjs

  vm.createContext(context);
  vm.runInContext(source, context);
  const stop = context.startApplicationChrome({
    initializeSettings: context.initKeySetup,

criticalSuspicious code is reachable from an entry pointFlagged files are imported by the application's entry path: src/layers/cyclones/index.js, src/layers/weather/index.js, src/layers/wind/index.js. This means the suspicious code can execute when the app runs.+8

warningCluster of suspicious files reachable from entry168 flagged files form a connected cluster that is reachable from an entry point, suggesting coordinated malicious behavior rather than isolated false positives.+5

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.src/layers/weather/index.js+4

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.server/providers/openai/instructions.js+4

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.src/layers/launches/panel.js+4

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.src/layers/alpr/index.js+3

warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.src/layers/cyclones/index.js+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.src/layers/cyclones/index.js+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.src/layers/directions/index.js+3

warningHigh-entropy string literalsFound 6 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.src/layers/weather/index.js+3

warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.src/layers/wind/index.js+3

infoSuspicious file in repoVery large source file (1945KB) — could contain obfuscated payloadsrc/data/local_data/cctv_ground_heights/cctv_ground_heights.json+2

infoSuspicious file in repoVery large source file (618KB) — could contain obfuscated payloadsrc/data/local_data/natural_earth/marine.json+2

infoSuspicious file in repoVery large source file (1941KB) — could contain obfuscated payloadsrc/data/local_data/natural_earth/regions.json+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

1353 files scanned @ 818b654 | 9/25/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration0

file system access0

obfuscation15

supply chain8

owasp / injection0

telemetry

files 1353/1492rules hit 21engine v6commit 818b654

github

bilawalsidhu/gods-eye-view

A spy satellite simulator in your browser, except the data is real. Live open source spatial intelligence on a photorealistic 3D globe.

JavaScript

42578

8663

94d

1492 files

1353 scanned(91%)

818b654

architecture░▒▓

entry (147) flagged (313) pkg (33)

454 nodes · 625 edgesscroll to zoom · click node to jump to finding