github.com / harry0703

harry0703/MoneyPrinterTurbo

Python·204 files·commit eb8c237·scanned 23h ago·cached ✓

15/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 15 — 118,041+ stars — findings likely false positives

verdict accurate?

118,041 stars

threat-state: lowlive

FINDINGS ░▒▓

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.test/services/test_state.py


    def eval(self, script, numkeys, key, *arguments):
        if isinstance(key, str):
            key = key.encode("utf-8")

criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.test/services/test_state.py


    def eval(self, script, numkeys, key, *arguments):
        if isinstance(key, str):
            key = key.encode("utf-8")

criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.test/services/test_webui_loomloom.py

    namespace = {"hashlib": hashlib, "json": json}
    exec(compile(module, str(WEBUI_MAIN), "exec"), namespace)
    signature = namespace["_loomloom_script_signature"]

    module = ast.fix_missing_locations(ast.Module(body=selected_nodes, type_ignores=[]))
    exec(compile(module, str(WEBUI_MAIN), "exec"), namespace)
    return namespace

warningSuspicious Windows batch commandBatch file contains commands commonly used to download and execute remote payloads (powershell, certutil, bitsadmin, curl to pipe, etc.).webui.bat

set "SELECTED_WEBUI_PORT="
for /f %%P in ('powershell -NoProfile -ExecutionPolicy Bypass -Command "$hostAddress=$null; foreach ($address in [Net.Dns]::GetHostAddresses($env:MPT_WEBUI_HOST)) { if ($add...

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.app/services/voice.py+4

warningHigh-entropy string literalsFound 7 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.app/models/llm_provider.py+3

warningHigh-entropy string literalsFound 8 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.app/services/elevenlabs_music.py+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.app/services/llm.py+3

warningHigh-entropy string literalsFound 6 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.app/services/loomloom.py+3

infoSuspicious file in repoExecutable file (webui.bat) in repositorywebui.bat+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

113 files scanned @ eb8c237 | 8/28/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration0

file system access0

obfuscation15

supply chain2

owasp / injection0

telemetry

files 113/204rules hit 12engine v5commit eb8c237

github

harry0703/MoneyPrinterTurbo

利用 AI 大模型和自动化工作流，根据主题或关键词一键生成高清短视频。Generate HD short videos from a topic or keyword with an automated AI workflow.

Python

118041

17976

902d

204 files

113 scanned(55%)

eb8c237

architecture░▒▓

entry (2) flagged (35) pkg (115)

211 nodes · 676 edgesscroll to zoom · click node to jump to finding