davide-desio-eleva/kirograph

TypeScript·684 files·commit 78a3c7b·scanned 1h ago·cached ✓

70/100

DANGEROUS

Sensitive capability combinations reachable from entry points. Do not run without review.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?

Partial architecture graph

threat-state: dangerouslive

FINDINGS ░▒▓

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.test/patterns/mock/src/app.ts

export function runScript(code: string) {
  return eval(code);
}

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.test/patterns/mock/src/server.js

function executeExpression(expr) {
  return eval(expr);
}

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.src/bin/commands/help.ts

      ['kirograph vuln suppressions', 'List all active suppressions'],
      ['kirograph pattern "eval($X)"', 'Find all eval() calls'],
      ['kirograph pattern --list', 'Show all bundled SAST rules'...

warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.test/patterns/mock/src/handler.py

def run_ping(host):
    os.system("ping -c 1 " + host)

warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.test/patterns/mock/src/main.rs

pub fn read_raw(ptr: *const u8) -> u8 {
    unsafe { *ptr }
}

criticalSuspicious code is reachable from an entry pointFlagged files are imported by the application's entry path: src/architecture/index.ts, src/context/index.ts, src/resolution/index.ts. This means the suspicious code can execute when the app runs.+8

warningCluster of suspicious files reachable from entry29 flagged files form a connected cluster that is reachable from an entry point, suggesting coordinated malicious behavior rather than isolated false positives.+5

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.src/architecture/index.ts+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.src/context/index.ts+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.src/index.ts+3

warningHigh-entropy string literalsFound 5 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.src/vectors/index.ts+3

warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.src/compression/filters/aws.ts+3

warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.src/compression/filters/git.ts+3

warningPotential path traversalUser input used in file system paths without sanitization. Attacker can read/write arbitrary files.test/patterns/mock/src/app.ts

export function streamFile(req: any, res: any) {
  return fs.createReadStream(req.query);
}

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

530 files scanned @ 78a3c7b | 9/25/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration0

file system access0

obfuscation15

supply chain0

owasp / injection4

telemetry

files 530/684rules hit 15engine v6commit 78a3c7b

github

davide-desio-eleva/kirograph

Semantic code knowledge graph for Kiro: fewer tool calls, instant symbol lookups, 100% local.

TypeScript

152

182d

684 files

530 scanned(77%)

78a3c7b

architecture░▒▓

entry (1) flagged (77) pkg (34)

434 nodes · 1258 edgesscroll to zoom · click node to jump to finding