github.com / hcavarsan
hcavarsan/ kftray
Rust·446 files·commit f691109·scanned 2h ago·cached ✓
25/100
LOW RISK
Minor findings consistent with the project type. Nothing reachable from install hooks.
score capped at 25 — 1,563 stars — findings likely legitimate code patterns
verdict accurate?
Desktop app detected
threat-state: lowlive
FINDINGS ░▒▓
warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.crates/kftray-commons/src/lib.rs
let original_value = std::env::var(&key).ok();
unsafe { std::env::set_var(&key, value) };
EnvVarGuard {
key,+3warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.crates/kftray-commons/src/utils/config_dir.rs
// SAFETY: the descriptor is owned by `file` and outlives this call.
if unsafe { libc::flock(file.as_raw_fd(), libc::LOCK_EX | libc::LOCK_NB) } == 0 {
return Ok(true);
}+3warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.crates/kftray-commons/src/utils/config_state.rs
// process id.
let result = unsafe { libc::kill(pid, 0) };
result == 0 || std::io::Error::last_os_error().raw_os_error() == Some(libc::EPERM)
}+3criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.crates/kftray-commons/src/utils/github.rs
let output = Command::new("git")
.arg("clone")
.arg("--depth=1")+8criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.crates/kftray-helper/src/address_pool.rs
fn dead_pid() -> u32 {
let mut child = std::process::Command::new(if cfg!(windows) { "cmd" } else { "true" })
.args(if cfg!(windows) {
&["/C", "exit 0"][..]+8criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.crates/kftray-helper/src/client/binary_finder.rs
let mut target_triple = String::new();
if let Ok(output) = Command::new("rustc").args(["-Vv"]).output() {
let output_str = String::from_utf8_lossy(&output.stdout);
if let Some(...+8warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.crates/kftray-server/src/proxy/reverse_http.rs
#[tokio::test]
async fn http_proxy_should_stop_accepting_when_shutdown_signaled() {
let tunnel_server = Arc::new(WebSocketTunnelServer::new(0));
let listener = tokio::net::TcpL...+5warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.crates/kftui/src/tui/input/mod.rs
pub async fn drain_forwarding(&mut self) -> HashSet<i64> {
// Signalled before draining: an in-flight startup observes cancellation
// at its own safe points and runs its own rollb...+5warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.frontend/src/components/AddConfigModal/index.tsx+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.frontend/src/components/Footer/index.tsx+3
warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.frontend/src/components/PortForwardTable/ContextsAccordion/PortForwardRow/index.tsx+3
warningHigh-entropy string literalsFound 31 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.hacks/update_homebrew.py+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.hacks/update_homebrew.py+3
infoSuspicious file in repoExecutable file (kftui_installer.ps1) in repositoryhacks/kftui_installer.ps1+2
Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.
312 files scanned @ f691109 | 9/25/2026 | heuristic scan — always review manually
risk by category
code execution25
network & exfiltration10
file system access0
obfuscation15
supply chain4
owasp / injection0
telemetry
files 312/446rules hit 16engine v6commit f691109
github
hcavarsan/kftray
kubectl port-forward manager and reverse tunnel (ngrok-like) for exposing local services publicly, with TLS termination, HTTP traffic inspection, UDP forwarding, multi-hop proxy routing through k8s clusters, stateful config via filesystem or git - GUI and TUI available
1563
78
1034d
446 files
312 scanned(70%)
f691109
architecture░▒▓
entry (1) flagged (48) pkg (350)
632 nodes · 1113 edgesscroll to zoom · click node to jump to finding