live · scanning repos
Scanrepo
github.com
github.com / harry0703

harry0703/MangoDisk

Rust·1816 files·commit 56498b0·scanned 4d ago·cached ✓
25/100
LOW RISK
Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 25 — 4,713 stars — findings likely legitimate code patterns

verdict accurate?
Partial architecture graph
Desktop app detected
threat-state: lowlive

FINDINGS ░▒▓

warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.scripts/test-linux-bundle.py
        delegate.chmod(0o755)
        result = subprocess.run(
            ["bash", str(launcher), "argument with spaces", "--flag"],
            capture_output=True,
+4
warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.src-tauri/crates/mangodisk-core/src/applications/binary_optimization/macos_universal_binaries.rs
        // SAFETY: CString provides a valid NUL-terminated path for this call.
        unsafe { libc::access(path.as_ptr(), libc::W_OK | libc::X_OK) == 0 }
    }
+3
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.src-tauri/crates/mangodisk-core/src/applications/binary_optimization/macos_universal_binaries.rs
            // source because an Apple silicon Mac should retain arm64 code.
            let apple_silicon = Command::new("/usr/sbin/sysctl")
                .args(["-n", "hw.optional.arm64"])
       ...
+8
warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.src-tauri/crates/mangodisk-core/src/applications/leftovers/macos.rs
    }
    if metadata.uid() != unsafe { libc::geteuid() } {
        return Err("container is not owned by the current user"
            .to_string()
+3
warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.src-tauri/crates/mangodisk-core/src/applications/uninstall/service.rs
    let writable_directory = |directory: &std::path::Path| {
        CString::new(directory.as_os_str().as_bytes()).is_ok_and(|directory| unsafe {
            libc::access(directory.as_ptr(), libc::W_...
+3
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.src-tauri/crates/mangodisk-core/src/cleanup/cleaners/project_artifact_protection.rs
    fn git(path: &Path, args: &[&str]) {
        let output = std::process::Command::new("git")
            .arg("-C")
            .arg(path)
+8
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.src-tauri/crates/mangodisk-core/src/cleanup/cleaners/project_artifacts_execution_tests.rs
fn git(repository: &Path, args: &[&str]) {
    let output = Command::new("git")
        .arg("-C")
        .arg(repository)
+8
infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2
warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.src-tauri/crates/mangodisk-core/src/ai/feedback.rs
    #[tokio::test]
    #[ignore = "requires the explicitly configured local website and synthetic build signing key"]
    async fn local_website_feedback_preserves_quota_for_every_module() {
        l...
+5
warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.src-tauri/crates/mangodisk-core/src/ai/official.rs
    let id = option_env!("MANGODISK_AI_KEY_ID").ok_or(AiError::FreeUnavailable)?;
    let raw = option_env!("MANGODISK_AI_SIGNING_KEY").ok_or(AiError::FreeUnavailable)?;
    let key = URL_SAFE_NO_PAD
...
+5
warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.src-tauri/crates/mangodisk-core/src/ai/official_protocol.rs
        "AI_CLOCK_SKEW" => AiError::FreeClockSkew,
        "AI_SIGNATURE_INVALID" => AiError::FreeSignatureInvalid,
        "AI_REPLAY_DETECTED" | "AI_REQUEST_EXISTS" | "AI_REQUEST_CONFLICT" => {
    ...
+5
criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.src-tauri/crates/mangodisk-core/src/cleanup/rules/brave_origin_tests.rs
        let relative_data = if platform == SourcePlatform::Windows {
            "BraveSoftware/Brave-Origin/User Data"
        } else {
            "BraveSoftware/Brave-Origin"
+10
criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.src-tauri/crates/mangodisk-core/src/cleanup/rules/declarative_catalog.rs
        assert!(rule.rule.roots.iter().all(|root| {
            root.template.contains("/BraveSoftware/Brave-Origin")
                && !root.template.contains("Brave-Browser")
        }));
+10
criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.src-tauri/crates/mangodisk-core/src/cleanup/rules/documented_cache_tests.rs
            ("browser.chrome-cache", "Google/Chrome"),
            ("browser.brave-cache", "BraveSoftware/Brave-Browser"),
            ("browser.edge-cache", "Microsoft Edge"),
        ],
+10
warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.src-tauri/crates/mangodisk-core/src/cleanup/rules/protected_paths.rs
    ".git-credentials",
    ".gnupg",
    ".idea",
    ".kube",
+5
infoSuspicious file in repoExecutable file (steps.ps1) in repositorysrc-tauri/crates/mangodisk-platform/src/windows/system_maintenance/steps.ps1+2
infoSuspicious file in repoExecutable file (PawnIO_setup.exe) in repositorysrc-tauri/crates/mangodisk-privileged/vendors/pawnio/2.2.0/PawnIO_setup.exe+2
infoSuspicious file in repoExecutable file (test-installer-hooks.ps1) in repositorysrc-tauri/nsis/test-installer-hooks.ps1+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

1175 files scanned @ 56498b0 | 10/25/2026 | heuristic scan — always review manually

risk by category
code execution25
network & exfiltration15
file system access20
obfuscation0
supply chain6
owasp / injection0
telemetry
files 1175/1816rules hit 18engine v7commit 56498b0

github

harry0703/MangoDisk

Safety-first disk cleaner and space analyzer for macOS, Windows and Linux, with duplicate cleanup, app uninstall, startup management, system optimization, and maintenance.

Rust
4713
324
90d
1816 files
1175 scanned(65%)
56498b0

architecture░▒▓

entry (1) flagged (189) pkg (171)
571 nodes · 587 edgesscroll to zoom · click node to jump to finding
LOW (25/100) — harry0703/MangoDisk — ScanRepo