DANGER

malware detected

github.com / duc01226

duc01226/EasyPlatform

JavaScript·3662 files·commit 1b6bdf1·scanned 4d ago·cached ✓

84/100

MALICIOUS

Matches known-malicious patterns. Do not clone or install.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?

27% file coverage

Partial architecture graph

threat-state: maliciouslive

FINDINGS ░▒▓

criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings..claude/scripts/codex/tests/decoder-parity.test.mjs

  assert.notEqual(end, -1, `no top-level closing brace for ${name}() in ${path.relative(repoRoot, file)}`);
  return new Function(`${src.slice(start, end + 2)}; return ${name};`)();
}

criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings..claude/scripts/codex/tests/hook-documentation-contract.test.mjs

    const input = { tool_input: { command: 'old && unrelated', timeout: 1234, cwd: '/fixture', extra: 'keep' } };
    const output = JSON.parse(new Function('input', 'rewrittenCommand', source)(input,...

warningSuspicious Windows batch commandBatch file contains commands commonly used to download and execute remote payloads (powershell, certutil, bitsadmin, curl to pipe, etc.).src/GenerateHttpsCertForDocker/PLATFORM-APIS-DOCKER-CreateHttpsCert-openssl.ps1-Start.cmd

TITLE "PLATFORM APIS DOCKER Create Https Openssl Cert"
powershell -executionpolicy bypass -noexit -File .\PLATFORM-APIS-DOCKER-CreateHttpsCert-openssl.ps1
pause

TITLE "PLATFORM APIS DOCKER Create Https Cert"
powershell -executionpolicy bypass -noexit -File .\PLATFORM-APIS-DOCKER-CreateHttpsCert.ps1
pause

criticalchild_process / exec usageExecuting shell commands can be used to download and run malware, exfiltrate data, or modify system files..claude/hooks/post-edit-prettier.cjs

const path = require('path');
const { execFile, spawn } = require('child_process');

// ═══════════════════════════════════════════════════════════════════════════

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens..agents/skills/pdf-convert/to-pdf/scripts/lib/chrome-finder.cjs

    path.join(process.env['PROGRAMFILES(X86)'] || '', 'Google', 'Chrome', 'Application', 'chrome.exe'),
    path.join(process.env.LOCALAPPDATA || '', 'Google', 'Chrome', 'Application', 'chrome.exe'),
...

+10

criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens..claude/skills/pdf-convert/to-pdf/scripts/lib/chrome-finder.cjs

    path.join(process.env['PROGRAMFILES(X86)'] || '', 'Google', 'Chrome', 'Application', 'chrome.exe'),
    path.join(process.env.LOCALAPPDATA || '', 'Google', 'Chrome', 'Application', 'chrome.exe'),
...

+10

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order..agents/skills/task-track/lib/report-view.cjs+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order..claude/hooks/ai-feature-route.cjs+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order..claude/hooks/lib/project-config-schema.cjs+3

warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode..claude/hooks/lib/startup-install-lock.cjs+3

infoSuspicious file in repoExecutable file (install.ps1) in repository.agents/skills/install.ps1+2

infoSuspicious file in repoExecutable file (notify-windows.ps1) in repository.claude/hooks/lib/notify-windows.ps1+2

infoSuspicious file in repoExecutable file (install.ps1) in repository.claude/skills/install.ps1+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

981 files scanned @ 1b6bdf1 | 10/25/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration0

file system access20

obfuscation15

supply chain15

owasp / injection0

telemetry

files 981/3662rules hit 15engine v7commit 1b6bdf1

github

duc01226/EasyPlatform

JavaScript

1960d

3662 files

981 scanned(27%)

1b6bdf1

architecture░▒▓

entry (0) flagged (11) pkg (107)

507 nodes · 701 edgesscroll to zoom · click node to jump to finding