github.com / harry0703
harry0703/ MangoDisk
Rust·1816 files·commit 56498b0·scanned 4d ago·cached ✓
25/100
LOW RISK
Minor findings consistent with the project type. Nothing reachable from install hooks.
score capped at 25 — 4,713 stars — findings likely legitimate code patterns
verdict accurate?
Partial architecture graph
Desktop app detected
threat-state: lowlive
FINDINGS ░▒▓
warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.scripts/test-linux-bundle.py
delegate.chmod(0o755)
result = subprocess.run(
["bash", str(launcher), "argument with spaces", "--flag"],
capture_output=True,+4warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.src-tauri/crates/mangodisk-core/src/applications/binary_optimization/macos_universal_binaries.rs
// SAFETY: CString provides a valid NUL-terminated path for this call.
unsafe { libc::access(path.as_ptr(), libc::W_OK | libc::X_OK) == 0 }
}
+3criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.src-tauri/crates/mangodisk-core/src/applications/binary_optimization/macos_universal_binaries.rs
// source because an Apple silicon Mac should retain arm64 code.
let apple_silicon = Command::new("/usr/sbin/sysctl")
.args(["-n", "hw.optional.arm64"])
...+8warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.src-tauri/crates/mangodisk-core/src/applications/leftovers/macos.rs
}
if metadata.uid() != unsafe { libc::geteuid() } {
return Err("container is not owned by the current user"
.to_string()+3warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.src-tauri/crates/mangodisk-core/src/applications/uninstall/service.rs
let writable_directory = |directory: &std::path::Path| {
CString::new(directory.as_os_str().as_bytes()).is_ok_and(|directory| unsafe {
libc::access(directory.as_ptr(), libc::W_...+3criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.src-tauri/crates/mangodisk-core/src/cleanup/cleaners/project_artifact_protection.rs
fn git(path: &Path, args: &[&str]) {
let output = std::process::Command::new("git")
.arg("-C")
.arg(path)+8criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.src-tauri/crates/mangodisk-core/src/cleanup/cleaners/project_artifacts_execution_tests.rs
fn git(repository: &Path, args: &[&str]) {
let output = Command::new("git")
.arg("-C")
.arg(repository)+8warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.src-tauri/crates/mangodisk-core/src/ai/feedback.rs
#[tokio::test]
#[ignore = "requires the explicitly configured local website and synthetic build signing key"]
async fn local_website_feedback_preserves_quota_for_every_module() {
l...+5warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.src-tauri/crates/mangodisk-core/src/ai/official.rs
let id = option_env!("MANGODISK_AI_KEY_ID").ok_or(AiError::FreeUnavailable)?;
let raw = option_env!("MANGODISK_AI_SIGNING_KEY").ok_or(AiError::FreeUnavailable)?;
let key = URL_SAFE_NO_PAD
...+5warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.src-tauri/crates/mangodisk-core/src/ai/official_protocol.rs
"AI_CLOCK_SKEW" => AiError::FreeClockSkew,
"AI_SIGNATURE_INVALID" => AiError::FreeSignatureInvalid,
"AI_REPLAY_DETECTED" | "AI_REQUEST_EXISTS" | "AI_REQUEST_CONFLICT" => {
...+5criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.src-tauri/crates/mangodisk-core/src/cleanup/rules/brave_origin_tests.rs
let relative_data = if platform == SourcePlatform::Windows {
"BraveSoftware/Brave-Origin/User Data"
} else {
"BraveSoftware/Brave-Origin"+10criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.src-tauri/crates/mangodisk-core/src/cleanup/rules/declarative_catalog.rs
assert!(rule.rule.roots.iter().all(|root| {
root.template.contains("/BraveSoftware/Brave-Origin")
&& !root.template.contains("Brave-Browser")
}));+10criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.src-tauri/crates/mangodisk-core/src/cleanup/rules/documented_cache_tests.rs
("browser.chrome-cache", "Google/Chrome"),
("browser.brave-cache", "BraveSoftware/Brave-Browser"),
("browser.edge-cache", "Microsoft Edge"),
],+10warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.src-tauri/crates/mangodisk-core/src/cleanup/rules/protected_paths.rs
".git-credentials",
".gnupg",
".idea",
".kube",+5infoSuspicious file in repoExecutable file (steps.ps1) in repositorysrc-tauri/crates/mangodisk-platform/src/windows/system_maintenance/steps.ps1+2
infoSuspicious file in repoExecutable file (PawnIO_setup.exe) in repositorysrc-tauri/crates/mangodisk-privileged/vendors/pawnio/2.2.0/PawnIO_setup.exe+2
infoSuspicious file in repoExecutable file (test-installer-hooks.ps1) in repositorysrc-tauri/nsis/test-installer-hooks.ps1+2
Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.
1175 files scanned @ 56498b0 | 10/25/2026 | heuristic scan — always review manually
risk by category
code execution25
network & exfiltration15
file system access20
obfuscation0
supply chain6
owasp / injection0
telemetry
files 1175/1816rules hit 18engine v7commit 56498b0
github
harry0703/MangoDisk
Safety-first disk cleaner and space analyzer for macOS, Windows and Linux, with duplicate cleanup, app uninstall, startup management, system optimization, and maintenance.
4713
324
90d
1816 files
1175 scanned(65%)
56498b0
architecture░▒▓
entry (1) flagged (189) pkg (171)
571 nodes · 587 edgesscroll to zoom · click node to jump to finding