github.com / jbangdev

jbangdev/jbang

Java·691 files·commit cae3ad7·scanned 27m ago·cached ✓

25/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 25 — 1,866 stars — findings likely legitimate code patterns

verdict accurate?

14% file coverage

threat-state: lowlive

FINDINGS ░▒▓

warningSuspicious Windows batch commandBatch file contains commands commonly used to download and execute remote payloads (powershell, certutil, bitsadmin, curl to pipe, etc.).src/main/scripts/jbang.cmd

  if not exist "%JBDIR%\bin\jbang.jar" (
    powershell -NoProfile -ExecutionPolicy Bypass -NonInteractive -Command "%~dp0jbang.ps1 version" > nul
    if !ERRORLEVEL! NEQ 0 ( exit /b %ERRORLEVEL% )
  ...

@@FOR /F "tokens=*" %%i in ('findstr -bv @@ "%~f0"') DO SET command=!command!!LF!%%i
@@powershell -noprofile -noexit -command !command! &amp; goto:eof

infoMinified code in source directoryMinified/obfuscated code in source directories (not dist/) makes code review impossible.src/test/resources/wiremock/__files/gists_bb5deb269de39eb8fca9636dd3c9f123-f922e800-434a-4e76-a7f4-c837d3e10bfc.json+3

infoSuspicious file in repoExecutable file (gradlew.bat) in repositorygradlew.bat+2

infoSuspicious file in repoExecutable file (echo.bat) in repositoryitests/echo.bat+2

infoSuspicious file in repoExecutable file (echo.ps1) in repositoryitests/echo.ps1+2

infoAuthor has no other public repositoriesGitHub user "allcontributors[bot]" has no other public repositories, common for burner accounts used in scams.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

94 files scanned @ cae3ad7 | 9/25/2026 | heuristic scan — always review manually

risk by category

code execution10

network & exfiltration0

file system access0

obfuscation3

supply chain15

owasp / injection0

telemetry

files 94/691rules hit 7engine v6commit cae3ad7

github

jbangdev/jbang

Unleash the power of Java - JBang Lets Students, Educators and Professional Developers create, edit and run self-contained source-only Java programs with unprecedented ease.

Java

1866

209

2466d

691 files

94 scanned(14%)

cae3ad7

architecture░▒▓

No architecture graph available. This usually happens when the repo contains no scannable JS/TS/Python files or only a single file was analyzed.