danyu6666/scan-repo

Shell·5 files·commit 66a9a71·scanned 4d ago·cached ✓

85/100

MALICIOUS

Matches known-malicious patterns. Do not clone or install.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?

No stars or forks

No community activity

threat-state: maliciouslive

FINDINGS ░▒▓

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.scan_repo.sh

  "$TARGET" 2>/dev/null | grep -v '^\s*//')
[ -n "$R" ] && scan_and_report "JS: eval(require) or dynamic bracket-notation execution" "med" "$R" \
            || flag_ok "No JS dynamic reflection execu...

criticalRemote script piped into a shellA shell script downloads remote content and executes it directly (e.g. `curl … | bash`). The payload is never stored or reviewable and can change server-side — a classic malware/backdoor install pattern.scan_repo.sh

  echo -e "${YELLOW}   The scanner script itself (scan_repo.sh) is inside the target directory.${NC}"
  echo -e "${YELLOW}   The scanner's own grep patterns contain strings like 'curl|bash',${NC}"
  e...

+10

warningSingle-commit repositoryThe repository has only one commit. This is common for generated or throwaway malware repos.+3

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

1 files scanned @ 66a9a71 | 8/21/2026 | heuristic scan — always review manually

risk by category

code execution18

network & exfiltration0

file system access0

obfuscation0

supply chain3

owasp / injection0

telemetry

files 1/5rules hit 3engine v5commit 66a9a71

github

danyu6666/scan-repo

A local shell script that scans GitHub repositories for malicious code before you run them

Shell

136d

5 files

1 scanned(20%)

66a9a71

architecture░▒▓

No architecture graph available. This usually happens when the repo contains no scannable JS/TS/Python files or only a single file was analyzed.