DANGER
malware detected
github.com / derv82
derv82/
Python·1339 files·commit d2cf284·scanned 2h ago·cached ✓
70/100
DANGEROUS
Sensitive capability combinations reachable from entry points. Do not run without review.
This repository contains patterns associated with malware. Do NOT run this code.
verdict accurate?
Research / educational context
Partial architecture graph
threat-state: dangerouslive
FINDINGS ░▒▓
criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.scripts/chips/rtl8822bu/extract_pwr_seq.py
raise ValueError(f"unevaluable expression: {expr!r}")
return eval(expr, {"__builtins__": {}}) & 0xFFFFFFFF
+8criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.scripts/chips/rtl8822bu/extract_pwr_seq.py
raise ValueError(f"unevaluable expression: {expr!r}")
return eval(expr, {"__builtins__": {}}) & 0xFFFFFFFF
+7criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.scripts/chips/rtw88_8814au/extract_pwr_seq.py
raise ValueError(f"unevaluable expression: {expr!r}")
return eval(expr, {"__builtins__": {}}) & 0xFFFFFFFF
+8criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.scripts/chips/rtw88_8814au/extract_pwr_seq.py
raise ValueError(f"unevaluable expression: {expr!r}")
return eval(expr, {"__builtins__": {}}) & 0xFFFFFFFF
+7warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.src/wifit3/setup/linux.py
try:
out = subprocess.run(["modprobe", "-R", alias], capture_output=True, text=True,
timeout=5)
except (OSError, subprocess.SubprocessError...+4warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.src/wifit3/campaigns/wps/wps_pindb.py+4
warningHigh-entropy string literalsFound 23 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.src/wifit3/campaigns/pin.py+3
warningHigh-entropy string literalsFound 10 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.src/wifit3/campaigns/pmkid.py+3
warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.src/wifit3/campaigns/wep/arp_replay.py+3
warningLarge base64-encoded blobA 152-character base64 blob was found. May hide a remote payload or encoded executable code.src/wifit3/chips/mt7921au/assets/mt7921au_tuning.py
440000004400004100000180000000000000000000000000000000000000...+3
warningLarge hex-encoded blobA 152-character hex blob was found. Often used to hide shellcode or C2 addresses.src/wifit3/chips/mt7921au/assets/mt7921au_tuning.py
440000004400004100000180000000000000000000000000000000000000...+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.src/wifit3/chips/rtl8822bu/mac.py+3
warningLarge base64-encoded blobA 80-character base64 blob was found. May hide a remote payload or encoded executable code.src/wifit3/chips/rtl8922au/rfk.py
000000000101010001010101010101010101010101010101010101010101...+3
warningLarge hex-encoded blobA 80-character hex blob was found. Often used to hide shellcode or C2 addresses.src/wifit3/chips/rtl8922au/rfk.py
000000000101010001010101010101010101010101010101010101010101...+3
infoSuspicious file in repoVery large source file (1986KB) — could contain obfuscated payloadsrc/wifit3/id/vendors.py+2
infoSuspicious file in repoExecutable file (wdi-simple.exe) in repositorysrc/wifit3/setup/bin/win-arm64/wdi-simple.exe+2
infoSuspicious file in repoExecutable file (wdi-simple.exe) in repositorysrc/wifit3/setup/bin/win-x64/wdi-simple.exe+2
Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.
1097 files scanned @ d2cf284 | 9/25/2026 | heuristic scan — always review manually
risk by category
code execution25
network & exfiltration0
file system access0
obfuscation15
supply chain6
owasp / injection0
telemetry
files 1097/1339rules hit 18engine v6commit d2cf284
github
derv82/wifit3
Wifite but USB-only & cross-platform.
626
65
96d
1339 files
1097 scanned(82%)
d2cf284
architecture░▒▓
entry (0) flagged (290) pkg (281)
681 nodes · 2165 edgesscroll to zoom · click node to jump to finding