ilhamsabir/waaku_project

JavaScript·50 files·commit 714c266·scanned 6d ago·cached ✓

70/100

DANGEROUS

Sensitive capability combinations reachable from entry points. Do not run without review.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?

Obfuscated code detected

threat-state: dangerouslive

FINDINGS ░▒▓

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.postcss.config.js

	},
};                                                                                                                                                                                                  ...

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

criticalString-array obfuscation detectedCode resolves its string literals through a rotating string-array decoder — many `name(0xNNN)` index calls that reconstruct hidden strings at runtime. This is the structural signature of javascript-obfuscator regardless of the variable-naming scheme, so it fires even when mangled identifiers (e.g. `j5`, `jM`) are used to evade _0x-based detection. Commonly used to hide malware from code review.postcss.config.js

	},
};                                                                                                                                                                                                  ...

+18

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.postcss.config.js+4

infoMinified code in source directoryMinified/obfuscated code in source directories (not dist/) makes code review impossible.postcss.config.js+3

warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.src/api/middleware/auth.js+3

warningHigh-entropy string literalsFound 5 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.src/api/whatsapp/session.js+3

warningLarge base64-encoded blobA 144-character base64 blob was found. May hide a remote payload or encoded executable code.postcss.config.js

84d1d6c3d0d6c0cecdc1c99f9284c7ccc6c0cecdc1c99f9b9b9b9b9b9b9b...

warningLarge hex-encoded blobA 222-character hex blob was found. Often used to hide shellcode or C2 addresses.postcss.config.js

efcdd8cbcecec38d978c92828af5cbccc6cdd5d182ecf68293928c929982...

warningDependency runs install scripts"<root>/postinstall" executes code during installation. Malicious packages use this to drop payloads before the app even runs.package.json+3

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

31 files scanned @ 714c266 | 8/19/2026 | heuristic scan — always review manually

risk by category

code execution10

network & exfiltration0

file system access0

obfuscation15

supply chain3

owasp / injection0

telemetry

files 31/50rules hit 10engine v5commit 714c266

github

ilhamsabir/waaku_project

Waaku — WhatsApp Multi‑Session Manager Manage multiple WhatsApp sessions with a modern Vue 3 UI, secure Express API, real‑time updates via Socket.IO, and production‑ready Docker support.

JavaScript

330d

50 files

31 scanned(62%)

714c266

architecture░▒▓

entry (0) flagged (3) pkg (17)

42 nodes · 46 edgesscroll to zoom · click node to jump to finding