live · scanning repos
Scanrepo
github.com
DANGER
malware detected
github.com / blocklechain

blocklechain/blockle

JavaScript·1059 files·commit 4fb70ee·scanned 4d ago·cached ✓
100/100
MALICIOUS
Matches known-malicious patterns. Do not clone or install.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?
Created 21 days ago
Created 21 days ago
Partial architecture graph
threat-state: maliciouslive

FINDINGS ░▒▓

warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.chain/crates/zk/src/rescue.rs
        let len = hashes.len() * DIGEST_SIZE;
        unsafe { slice::from_raw_parts(p as *const BaseElement, len) }
    }
}
+3
criticalchild_process / exec usageExecuting shell commands can be used to download and run malware, exfiltrate data, or modify system files.services/accounts/src/email.js
  return new Promise((resolve, reject) => {
    const p = spawn('/usr/sbin/sendmail', ['-t', '-i'], { stdio: ['pipe', 'ignore', 'pipe'] });
    let err = '';
    p.stderr.on('data', (d) => { err += d;...
+8
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.src/discover.rs
        let _ = fs::remove_dir_all(&dest);
        let status = Command::new("git")
            .args(["clone", "--depth", "1", source])
            .arg(&dest)
+8
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.src/main.rs
        let run = |args: &[&str]| {
            std::process::Command::new(&bin)
                .args(["--datadir", &datadir])
                .args(args)
+8
criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.python/blockle/qtapp.py
    BLOCK wallet) are prepended before the multichain tabs. Does NOT call
    ``show()``/``exec()`` — safe to build headless."""
    win = QMainWindow()
    win.setWindowTitle(title)
+7
criticalBrowser wallet app with Node/system accessThe repository interacts with browser wallets but also accesses the filesystem or executes shell/code. This context mismatch is typical of hybrid drainer/infostealer malware.+10
infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2
warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.chain/crates/node/tests/direct_pool_e2e.rs
use blockle_chain::{mine_block, Chain, ChainParams};
use blockle_core::keys::{encode_address, Keypair};
use blockle_core::sha256d;
use blockle_node::stratum::{PoolMode, PoolOpts};
+5
warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.chain/crates/node/tests/stratum_e2e.rs
use blockle_chain::{mine_block, Chain, ChainParams};
use blockle_core::keys::Keypair;
use blockle_core::BlockHeader;
use blockle_node::{p2p, storage};
+5
warningPython wallet operations with network activityCode that signs blockchain transactions and also makes network requests may be exfiltrating private keys or sending funds to an attacker.python/blockle/moonpay.py+5
warningPython wallet operations with network activityCode that signs blockchain transactions and also makes network requests may be exfiltrating private keys or sending funds to an attacker.python/blockle/multichain/chains/chain_adapter.py+5
warningPython wallet operations with network activityCode that signs blockchain transactions and also makes network requests may be exfiltrating private keys or sending funds to an attacker.python/blockle/multichain/exchange.py+5
infoWallet transaction signing APIUses wallet signing APIs (signTransaction, signMessage, sendTransaction, etc.). Legitimate in DeFi apps, but combined with remote exfiltration it is the core drainer pattern.blockle-extension/wallet.js

    async signMessage(message) {
      if (!session.secret) throw new Error('locked');
      return Signer.signMessage(session.secret, session.pub, message);
+2
infoWallet transaction signing APIUses wallet signing APIs (signTransaction, signMessage, sendTransaction, etc.). Legitimate in DeFi apps, but combined with remote exfiltration it is the core drainer pattern.web/wallet/app.js
      try {
        var signed = await Wallet.signMessage(message);
        post({ type: 'blockle:connect:signed', address: signed.address || Wallet.address, publicKey: signed.publicKey || Wallet.publ...
+2
criticalCryptocurrency wallet directory accessAccessing wallet directories to steal private keys, seed phrases, or wallet data.blockle-extension/scripts/gen-export-vectors.js+5
infoWallet transaction signing APIUses wallet signing APIs (signTransaction, signMessage, sendTransaction, etc.). Legitimate in DeFi apps, but combined with remote exfiltration it is the core drainer pattern.sdk/src/agent.ts
      address: () => signer.address(),
      signNonce: (nonce: string) => signer.signMessage(nonce),
      async htlcLock(p: HtlcLockParams): Promise<HtlcReceipt> {
        const escrow = (p.extra?.e...
+2
warningSeed phrase / private key harvesting UICollects seed phrase, private key, or mnemonic from the user via input/textarea/clipboard/prompt. Wallet drainers and fake wallet apps use this to steal funds.services/accounts/src/pages.js

  support: () => `<div class="card">${brand}<h1>Contact support</h1><p class="sub">We'll reply by email. Never share your seed phrase or backup passphrase with anyone — support will never ask.</p>
<f...
+5
warningSeed phrase / private key harvesting UICollects seed phrase, private key, or mnemonic from the user via input/textarea/clipboard/prompt. Wallet drainers and fake wallet apps use this to steal funds.services/super-amm/src/custody-utxo.js
// BTC/LTC use public esplora). Signing via bitcoinjs-lib: P2WPKH (segwit) for
// BTC/LTC, legacy P2PKH for DOGE. Key file: { privateKeyHex }.
//
// Uniform adapter interface (see custody.js). testnet...
+5
warningSeed phrase / private key harvesting UICollects seed phrase, private key, or mnemonic from the user via input/textarea/clipboard/prompt. Wallet drainers and fake wallet apps use this to steal funds.blockle-extension/agent-ui.js
        <b>Use Blockle's hosted agent — no API key needed</b>
        <div class="notice" style="margin:6px 0">You sign a one-time challenge with your wallet (proves your address, not a spend). Blockl...
+5
criticalCryptocurrency wallet directory accessAccessing wallet directories to steal private keys, seed phrases, or wallet data.blockle-extension/backup-crypto.test.js+5
criticalCryptocurrency wallet directory accessAccessing wallet directories to steal private keys, seed phrases, or wallet data.exchange/contracts/collect-deployments.mjs+5
infoBrowser wallet provider accessAccesses browser wallet providers (window.solana, window.ethereum, Phantom, Solflare, etc.). Common in Web3 apps but also the entry point for wallet drainers.exchange/web/connectors.js+2
infoBrowser wallet provider accessAccesses browser wallet providers (window.solana, window.ethereum, Phantom, Solflare, etc.). Common in Web3 apps but also the entry point for wallet drainers.exchange/web/core.js
      kind: 'evm', chain: 'ethereum', label: 'MetaMask',
      present: function () { return typeof window.ethereum !== 'undefined'; },
      connect: async function () {
        if (!this.present()) ...
+2
infoBrowser wallet provider accessAccesses browser wallet providers (window.solana, window.ethereum, Phantom, Solflare, etc.). Common in Web3 apps but also the entry point for wallet drainers.exchange/web/list.js
    // EVM chains: native coin -> value transfer; token -> ERC-20 transfer call.
    if (!window.ethereum) throw new Error('MetaMask / EVM wallet not found');
    var accts = await window.ethereum.req...
+2
criticalSecret collection in crypto contextCollects seed phrases, private keys, or clipboard content while also targeting browser wallets. This is a wallet-stealer pattern.+10
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.blockle-extension/bip39-wordlist.js+4
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.services/accounts/public/app.js+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.web/wallet/app.js+3
warningLarge base64-encoded blobA 128-character base64 blob was found. May hide a remote payload or encoded executable code.blockle-extension/multichain.test.js
ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55...
+3
warningLarge hex-encoded blobA 142-character hex blob was found. Often used to hide shellcode or C2 addresses.blockle-extension/multichain.test.js
304402203609e17b84f6a7d30c80bfa610b5b4542f32a8a0d5447a12fb13...
+3
warningLarge hex-encoded blobA 138-character hex blob was found. Often used to hide shellcode or C2 addresses.blockle-extension/security.test.js
0xa22cb46500000000000000000000000011111111111111111111111111...
+3
warningLarge base64-encoded blobA 128-character base64 blob was found. May hide a remote payload or encoded executable code.blockle-extension/signing.test.js
e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e0652249...
+3
warningLarge hex-encoded blobA 138-character hex blob was found. Often used to hide shellcode or C2 addresses.blockle-extension/signing.test.js
0x095ea7b30000000000000000000000001111111254eeb25477b68fb85e...
+3
warningLarge base64-encoded blobA 228-character base64 blob was found. May hide a remote payload or encoded executable code.blockle-extension/wc-relay.test.js
d31a8d34648e60db7b86afbc53ef7ec2a4aded51296e08fea9e2b5a736ee...
+3
warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.python/blockle/qtmultichain.py+3
warningHigh-entropy string literalsFound 20 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.python/blockle/qtwalletui.py+3

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

597 files scanned @ 4fb70ee | 10/25/2026 | heuristic scan — always review manually

risk by category
code execution25
network & exfiltration25
file system access20
obfuscation15
supply chain0
owasp / injection0
telemetry
files 597/1059rules hit 36engine v7commit 4fb70ee

github

blocklechain/blockle

The universal deployment system for PoW mining pools — plus the BLOCK chain, Proof of Blocks, and the Blockle Qt wallet.

JavaScript
1
2
25d
1059 files
597 scanned(56%)
4fb70ee

architecture░▒▓

entry (5) flagged (31) pkg (148)
548 nodes · 909 edgesscroll to zoom · click node to jump to finding