github.com / hovancik

hovancik/stretchly

JavaScript·3086 files·commit d33ea65·scanned 5d ago·cached ✓

25/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 25 — 6,480 stars — findings likely legitimate code patterns

verdict accurate?

4% file coverage

threat-state: lowlive

FINDINGS ░▒▓

criticalSuspicious code is reachable from an entry pointFlagged files are imported by the application's entry path: app/utils/dndManager.js, app/breaksPlanner.js. This means the suspicious code can execute when the app runs.+8

warningCluster of suspicious files reachable from entry2 flagged files form a connected cluster that is reachable from an entry point, suggesting coordinated malicious behavior rather than isolated false positives.+5

warningHigh-entropy string literalsFound 11 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.app/main.js+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.app/main.js+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.app/utils/dndManager.js+3

warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.app/breaksPlanner.js+3

warningDependency runs install scripts"<root>/postinstall" executes code during installation. Malicious packages use this to drop payloads before the app even runs.package.json+3

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

117 files scanned @ d33ea65 | 8/19/2026 | heuristic scan — always review manually

risk by category

code execution13

network & exfiltration0

file system access0

obfuscation12

supply chain3

owasp / injection0

telemetry

files 117/3086rules hit 7engine v5commit d33ea65

github

hovancik/stretchly

The break time reminder app

JavaScript

6480

552

3697d

3086 files

117 scanned(4%)

d33ea65

architecture░▒▓

entry (1) flagged (3) pkg (22)

84 nodes · 136 edgesscroll to zoom · click node to jump to finding