github.com / dimensionalOS

dimensionalOS/dimos

Python·3120 files·commit 3e39e54·scanned 3d ago·cached ✓

25/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 25 — 4,685 stars — findings likely legitimate code patterns

verdict accurate?

Partial architecture graph

CLI tool detected

threat-state: lowlive

FINDINGS ░▒▓

warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.dimos/hardware/sensors/camera/realsense/rust/src/main.rs

) -> Image {
    let data = unsafe {
        std::slice::from_raw_parts(
            frame.get_data() as *const _ as *const u8,

        // SAFETY: path is NUL-terminated and error is a writable buffer of the given length.
        let raw = unsafe {
            ffi::capture_open(
                path.as_ptr(),

    // SAFETY: now is a valid timespec to write into.
    unsafe { libc::clock_gettime(libc::CLOCK_MONOTONIC, &mut now) };
    now.tv_sec as f64 + now.tv_nsec as f64 * 1e-9
}

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.dimos/navigation/local_planner/rust/src/planner.rs


    fn eval(&mut self, k: usize, b: usize, i: usize, j: usize) -> f64 {
        if self.w.lookup(self.gx[i], self.gy[j]) >= self.certify {
            self.t[k] = self.gov.speed_clearance;

criticalRemote script piped into a shellA shell script downloads remote content and executes it directly (e.g. `curl … | bash`). The payload is never stored or reviewable and can change server-side — a classic malware/backdoor install pattern.scripts/install.sh

# Usage:
#   curl -fsSL https://raw.githubusercontent.com/dimensionalOS/dimos/main/scripts/install.sh | bash
#   curl -fsSL https://raw.githubusercontent.com/dimensionalOS/dimos/main/scripts/install.s...

+10

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.dimos/cli/topic.py

    try:
        message = eval(message_expr, _build_eval_context())
    except Exception as e:
        typer.echo(f"Error parsing message: {e}", err=True)

criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.dimos/cli/topic.py

    try:
        message = eval(message_expr, _build_eval_context())
    except Exception as e:
        typer.echo(f"Error parsing message: {e}", err=True)

warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.dimos/core/native_module.py


        self._process = subprocess.Popen(
            cmd,
            env=env,

    assert config.build_command is not None
    process = subprocess.Popen(
        config.build_command,
        shell=True,

criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.dimos/models/vl/moondream.py

    def _model(self) -> AutoModelForCausalLM:
        """Load model with compile() for optimization."""
        model = AutoModelForCausalLM.from_pretrained(
            self.config.model_name,

            setup = Path(__file__).with_name("vendor_setup.sh")
            subprocess.run(["bash", str(setup), self.config.vendor_profile], check=True)

    @rpc

criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.dimos/simulation/dimsim/scene_client.py

to the browser-side SceneEditor.  Provides high-level helpers for common
operations (load map, add NPC, manage colliders) and a raw ``exec()`` escape
hatch for arbitrary Three.js code.
"""

sudo apt-get update
sudo apt-get install -y ca-certificates curl git g++ portaudio19-dev git-lfs libturbojpeg pre-commit libgl1 libegl1 libglib2.0-0 ffmpeg libsndfile1 pkg-config

# uv

+10

# Rust
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal
export PATH="$HOME/.cargo/bin:$PATH"

+10

criticalObfuscated payload executed in shellA shell script decodes an obfuscated blob (base64) and pipes it into an interpreter, hiding the real command from casual review.misc/fresh-ubuntu-tests/vmtest.sh

)"
  printf 'bash -c "echo %s | base64 -d | bash"' "$(printf '%s' "$script" | base64 -w0)"
}

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.web/sdk/src/transport.ts

  if (info.certHash !== undefined) {
    const hash = Uint8Array.from(atob(info.certHash), (c) => c.charCodeAt(0));
    options.serverCertificateHashes = [{ algorithm: "sha-256", value: hash }];
  }

warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.misc/fresh-ubuntu-tests/vmtest.sh

readonly LOG_DIR="$CACHE/logs"
readonly SSH_KEY="$SSH_DIR/id_ed25519"

# --- helpers ---

warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.dimos/cli/apriltag3d.py+3

warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.dimos/visualization/rerun/test_viewer_integration.py+3

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

2253 files scanned @ 3e39e54 | 10/26/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration2

file system access5

obfuscation6

supply chain0

owasp / injection0

telemetry

files 2253/3120rules hit 20engine v7commit 3e39e54

github

dimensionalOS/dimos

Dimensional is the agentic operating system for physical space. Command humanoids, quadrupeds, drones, and other hardware platforms in natural language and build multi-agent systems that work seamlessly with physical input (cameras, lidar, actuators).

Python

4685

833

740d

3120 files

2253 scanned(72%)

3e39e54

architecture░▒▓

entry (6) flagged (12) pkg (516)

916 nodes · 2165 edgesscroll to zoom · click node to jump to finding