live · scanning repos
Scanrepo
github.com
github.com / ethereum

ethereum/go-ethereum

Go·2426 files·commit 2006f08·scanned 4d ago·cached ✓
15/100
LOW RISK
Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 15 — 51,412+ stars — findings likely false positives

verdict accurate?
51,412 stars
Crypto/Web3 project
Partial architecture graph
threat-state: lowlive

FINDINGS ░▒▓

warningGo unsafe package usageunsafe package bypasses Go's type safety. Malware uses it for memory tricks, pointer casts, and hiding behavior.common/bitutil/bitutil.go
	"runtime"
	"unsafe"
)
+3
criticalGo os/exec usageos/exec is used to run external commands. In malware it drops payloads, modifies the system, or opens shells.accounts/abi/abigen/bind_test.go
	// Convert the package to go modules and use the current source for go-ethereum
	moder := exec.Command(gocmd, "mod", "init", "bindtest")
	moder.Dir = pkg
	if out, err := moder.CombinedOutput(); err !...
+8
warningGo unsafe package usageunsafe package bypasses Go's type safety. Malware uses it for memory tricks, pointer casts, and hiding behavior.cmd/keeper/getpayload_wasm.go
import (
	"unsafe"
)
+3
warningGo unsafe package usageunsafe package bypasses Go's type safety. Malware uses it for memory tricks, pointer casts, and hiding behavior.cmd/keeper/getpayload_womir.go

import "unsafe"

// These match the WOMIR guest-io imports (env module).
+3
criticalGo os/exec usageos/exec is used to run external commands. In malware it drops payloads, modifies the system, or opens shells.crypto/signify/signify_fuzz.go

	cmd := exec.Command(signify, "-V", "-p", pubKeyFile.Name(), "-x", tmpFile.Name()+".sig", "-m", tmpFile.Name())
	if output, err := cmd.CombinedOutput(); err != nil {
		panic(fmt.Sprintf("could not ve...
+8
criticalSolidity selfdestructselfdestruct destroys the contract and sends its balance to an address. It is a common rug-pull and attack primitive.tests/solidity/contracts/OpCodes.sol
     //selfdestruct
     assembly { selfdestruct(0x02) }
   }
+10
criticalBrowser wallet app with Node/system accessThe repository interacts with browser wallets but also accesses the filesystem or executes shell/code. This context mismatch is typical of hybrid drainer/infostealer malware.+10
infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2
warningHardcoded IP address in network callFetching data from hardcoded IP addresses instead of domain names is suspicious and may indicate C2 communication.node/rpcstack_test.go
		{
			spec:  "https://12.34.56.78",
			expOk: []string{"https://12.34.56.78", "https://12.34.56.78:8540"},
			expFail: []string{
+5
warningGo net/http with hardcoded IPHardcoded public IP addresses in HTTP clients are common in malware C2 configurations.node/rpcstack_test.go
		{
			spec:  "https://12.34.56.78",
			expOk: []string{"https://12.34.56.78", "https://12.34.56.78:8540"},
			expFail: []string{
+4
criticalWallet drainer pattern across filesThe repository touches browser wallet providers or signing APIs in one file and performs remote exfiltration/network calls in another. This is the canonical cross-file wallet drainer architecture.+12
criticalCryptocurrency wallet directory accessAccessing wallet directories to steal private keys, seed phrases, or wallet data.accounts/keystore/passphrase.go+5
criticalCryptocurrency wallet directory accessAccessing wallet directories to steal private keys, seed phrases, or wallet data.accounts/keystore/passphrase_test.go+5
criticalCryptocurrency wallet directory accessAccessing wallet directories to steal private keys, seed phrases, or wallet data.accounts/keystore/plain.go+5
infoWallet transaction signing APIUses wallet signing APIs (signTransaction, signMessage, sendTransaction, etc.). Legitimate in DeFi apps, but combined with remote exfiltration it is the core drainer pattern.ethclient/ethclient_test.go
	// send a transaction for some interesting pending status
	if err := sendTransaction(ec); err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
+2
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.accounts/abi/abi_test.go+4
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.accounts/abi/abigen/bind_test.go+4
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.accounts/abi/abigen/bindv2_test.go+4
infoMinified code in source directoryMinified/obfuscated code in source directories (not dist/) makes code review impossible.internal/jsre/deps/bignumber.js+3
warningSolidity inline assemblyInline assembly hides logic from high-level analysis and is often used in obfuscated exploits.tests/solidity/contracts/OpCodes.sol
     //simple_instructions
     /*assembly { pop(sub(dup1, mul(dup1, dup1))) }*/

     //keywords
+4
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.graphql/internal/graphiql/react-dom.production.min.js+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.internal/jsre/deps/bignumber.js+3
infoSuspicious file in repoVery large source file (928KB) — could contain obfuscated payloadbeacon/types/testdata/block_deneb.json+2
infoSuspicious file in repoVery large source file (1614KB) — could contain obfuscated payloadcmd/devp2p/internal/ethtest/testdata/newpayload.json+2
infoSuspicious file in repoVery large source file (849KB) — could contain obfuscated payloadcore/genesis_alloc.go+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

1851 files scanned @ 2006f08 | 10/25/2026 | heuristic scan — always review manually

risk by category
code execution25
network & exfiltration21
file system access20
obfuscation15
supply chain15
owasp / injection0
telemetry
files 1851/2426rules hit 25engine v7commit 2006f08

github

ethereum/go-ethereum

Go implementation of the Ethereum protocol

Go
51412
22109
4690d
2426 files
1851 scanned(76%)
2006f08

architecture░▒▓

entry (7) flagged (27) pkg (249)
649 nodes · 2360 edgesscroll to zoom · click node to jump to finding