github.com / jellyfin

jellyfin/jellyfin-desktop

C++·304 files·commit 2cb4a44·scanned 2d ago·cached ✓

17/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

verdict accurate?

13% file coverage

threat-state: lowlive

FINDINGS ░▒▓

warningSuspicious Windows batch commandBatch file contains commands commonly used to download and execute remote payloads (powershell, certutil, bitsadmin, curl to pipe, etc.).dev/windows/setup.bat

    if exist "!DEPS_DIR!\mpv_tmp" rmdir /s /q "!DEPS_DIR!\mpv_tmp"
    curl -L "https://github.com/shinchiro/mpv-winbuild-cmake/releases/download/!MPV_RELEASE!/mpv-dev-x86_64-v3-!MPV_VERSION!.7z" -o "...

infoSuspicious file in repoExecutable file (build.bat) in repositorydev/windows/build.bat+2

infoSuspicious file in repoExecutable file (bundle.bat) in repositorydev/windows/bundle.bat+2

infoSuspicious file in repoExecutable file (common.bat) in repositorydev/windows/common.bat+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

38 files scanned @ 2cb4a44 | 10/26/2026 | heuristic scan — always review manually

risk by category

code execution5

network & exfiltration0

file system access0

obfuscation0

supply chain12

owasp / injection0

telemetry

files 38/304rules hit 4engine v7commit 2cb4a44

github

jellyfin/jellyfin-desktop

Jellyfin Desktop Client

C++

5916

573

2035d

304 files

38 scanned(13%)

2cb4a44

architecture░▒▓

entry (0) flagged (0) pkg (0)

8 nodes · 0 edgesscroll to zoom · click node to jump to finding