dayfinggg/codex-discord-presence

TypeScript·74 files·commit 66af20c·scanned 17m ago·cached ✓

69/100

DANGEROUS

Sensitive capability combinations reachable from entry points. Do not run without review.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?

Crypto/Web3 project

CLI tool detected

threat-state: dangerouslive

FINDINGS ░▒▓

criticalchild_process / exec usageExecuting shell commands can be used to download and run malware, exfiltrate data, or modify system files.src/codex/desktop-selection.ts

      try {
        const child = spawn("powershell", ["-NoProfile", "-NonInteractive", "-Command", WINDOWS_UI_WATCH_SCRIPT], {
          windowsHide: true,
          stdio: ["ignore", "pipe", "ignore...

criticalchild_process / exec usageExecuting shell commands can be used to download and run malware, exfiltrate data, or modify system files.src/util/process-scan-watcher.ts

    if (this.stopped) return;
    const child = spawn(
      "powershell",
      ["-NoProfile", "-NonInteractive", "-Command", buildScript(this.nameFilter)],

criticalSuspicious code is reachable from an entry pointFlagged files are imported by the application's entry path: src/codex/codex-store.ts, src/codex/desktop-selection.ts, src/codex/goal-watcher.ts. This means the suspicious code can execute when the app runs.+8

warningCluster of suspicious files reachable from entry12 flagged files form a connected cluster that is reachable from an entry point, suggesting coordinated malicious behavior rather than isolated false positives.+5

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.src/index.ts+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.src/codex/codex-store.ts+3

warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.src/codex/desktop-selection.ts+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.src/codex/desktop-selection.ts+3

warningHigh-entropy string literalsFound 7 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.src/discord/presence-builder.ts+3

infoSuspicious file in repoExecutable file (remove-autostart.ps1) in repositoryscripts/remove-autostart.ps1+2

infoSuspicious file in repoExecutable file (run-service.ps1) in repositoryscripts/run-service.ps1+2

infoSuspicious file in repoExecutable file (setup-autostart.ps1) in repositoryscripts/setup-autostart.ps1+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

58 files scanned @ 66af20c | 9/25/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration0

file system access0

obfuscation15

supply chain6

owasp / injection0

telemetry

files 58/74rules hit 12engine v6commit 66af20c

github

dayfinggg/codex-discord-presence

Discord Rich Presence for OpenAI Codex Desktop and CLI with live models, plan limits, token usage, goals, Fast mode, and secure SSH remotes.

TypeScript

66d

74 files

58 scanned(78%)

66af20c

architecture░▒▓

entry (1) flagged (13) pkg (4)

56 nodes · 104 edgesscroll to zoom · click node to jump to finding