github.com / confident-ai
confident-ai/ deepeval
Python·2969 files·commit 7e94626·scanned 4m ago·cached ✓
15/100
LOW RISK
Minor findings consistent with the project type. Nothing reachable from install hooks.
score capped at 15 — 18,435+ stars — findings likely false positives
verdict accurate?
18,435 stars
Research / educational context
Partial architecture graph
threat-state: lowlive
FINDINGS ░▒▓
criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.typescript/test/test-integrations/test-langchain/apps/langchain-agent-app.ts
if ([...input.expression].every((c) => allowed.has(c)))
return `Calculation: ${input.expression} = ${eval(input.expression)}`;
return "Invalid expression";
} catch (e: any) {+8criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.typescript/test/test-integrations/test-langchain/apps/langchain-metric-collection-app.ts
return "Error: Invalid characters";
return String(eval(input.expression));
} catch (e: any) {
return `Error: ${e.message}`;+8criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.typescript/test/test-integrations/test-langchain/apps/langchain-multiple-tools-app.ts
if ([...input.expression].every((c) => allowedChars.has(c))) {
return `${input.expression} = ${eval(input.expression)}`;
}
return "Invalid expression";+8criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.deepeval/benchmarks/human_eval/human_eval.py
# Compile the code first to validate syntax
compiled_code = compile(code_str, "<string>", "exec")
# Execute with restricted environment
exec(compiled_code, safe_globals...+7warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.deepeval/utils.py
os.system("nvidia-smi -q -d Memory |grep -A4 GPU|grep Free >tmp_smi")
memory_available = [
int(x.split()[2]) + 5 * i+4criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.tests/test_integrations/test_langchain/apps/langchain_agent_app.py
if all(c in allowed for c in expression):
result = eval(expression)
return f"Calculation: {expression} = {result}"
return "Invalid expression"+7criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.tests/test_integrations/test_langchain/apps/langchain_metric_collection_app.py
return "Error: Invalid characters in expression"
result = eval(expression)
return str(result)
except Exception as e:+7infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.typescript/src/models/multimodal.ts
format: bedrockImageFormat(mimeType),
source: { bytes: Buffer.from(data, "base64") },
},
});+2criticalCryptocurrency wallet directory accessAccessing wallet directories to steal private keys, seed phrases, or wallet data.typescript/src/config/keystore.ts
try {
const raw = fs.readFileSync(keystorePath(), "utf-8");
const parsed = JSON.parse(raw) as unknown;
if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {+5criticalCryptocurrency wallet directory accessAccessing wallet directories to steal private keys, seed phrases, or wallet data.typescript/src/config/settings.ts+5
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.typescript/src/templates/classifiers/templates.json+4
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.typescript/src/templates/simulator/templates.json+4
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.deepeval/benchmarks/squad/template.py+4
warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.typescript/src/cli/commands/auth.ts+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.typescript/src/cli/commands/auth.ts+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.typescript/src/integrations/ai-sdk/index.ts+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.typescript/src/integrations/openinference/index.ts+3
warningHigh-entropy string literalsFound 10 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode..scripts/changelog/generate.py+3
warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode..scripts/changelog/release_notes.py+3
infoSuspicious file in repoVery large source file (541KB) — could contain obfuscated payloadtypescript/package-lock.json+2
warningDependency runs install scripts"<root>/postinstall" executes code during installation. Malicious packages use this to drop payloads before the app even runs.package.json+3
warningHardcoded secret/credentialAPI keys, passwords, or tokens hardcoded in source code. Should be in environment variables.typescript/src/telemetry/client.ts+3
warningHardcoded secret/credentialAPI keys, passwords, or tokens hardcoded in source code. Should be in environment variables.tests/test_docs/test_confident/test_integrations/test_crewai.py
instrument_crewai(api_key="q8/AU3bxv2MX0mBnW9I8ynOVNx/iV3mMH3oqkl2Isu4=") # Define your agents with roles and goals+3
Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.
2052 files scanned @ 7e94626 | 9/25/2026 | heuristic scan — always review manually
risk by category
code execution25
network & exfiltration2
file system access10
obfuscation15
supply chain5
owasp / injection6
telemetry
files 2052/2969rules hit 24engine v6commit 7e94626
github
confident-ai/deepeval
The LLM Evaluation Framework
18435
1977
1142d
2969 files
2052 scanned(69%)
7e94626
architecture░▒▓
entry (1) flagged (139) pkg (620)
1020 nodes · 1954 edgesscroll to zoom · click node to jump to finding