github.com / jub0t
jub0t/ concat
Rust·1215 files·commit 797c8c7·scanned 5d ago·cached ✓
15/100
LOW RISK
Minor findings consistent with the project type. Nothing reachable from install hooks.
score capped at 15 — 10,823+ stars — findings likely false positives
verdict accurate?
10,823 stars
22% file coverage
threat-state: lowlive
FINDINGS ░▒▓
warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.src/crates/concat-android/src/lib.rs
// thread starts, so no other thread reads the environment.
unsafe {
std::env::set_var("XDG_CONFIG_HOME", &internal);
std::env::set_var("XDG_DATA_HOME", &intern...+3criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.src/crates/concat-effects/src/expr.rs
/// Evaluates against `env`, the values every name resolves to.
pub fn eval(&self, env: &BTreeMap<String, Value>) -> Result<Value, EvalError> {
match self {
Expr::Number(n)...+8warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.src/crates/concat-host/src/crash.rs
// which only read what is set here.
unsafe { platform::install() }
});
}+3criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.src/crates/concat-host/src/crash.rs
}
let out = std::process::Command::new(std::env::current_exe().unwrap())
.args([
"--exact",+8warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.src/crates/concat-host/src/jobs.rs
// signalled, and touches no memory of ours.
let answer = unsafe { libc::kill(pid, 0) };
answer == 0 || std::io::Error::last_os_error().raw_os_error() == Some(libc::EPERM)
}+3criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.src/crates/concat-host/src/lock.rs
let scratch = tempfile::tempdir().expect("scratch");
let mut child = Command::new(std::env::current_exe().expect("this test"))
.args([
"--exact",+8criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.src/crates/concat-host/src/updates.rs
Path::new("/var/lib/rpm").exists()
&& Command::new("rpm")
.args(["-q", "concat"])
.output()+8warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.src/crates/concat-host/src/updates.rs
let _ = std::fs::remove_dir_all(&retired);
// ditto, not a copy of our own: it keeps the bundle's signature,
// its links and its resource forks as the Finder would.
run(Command::new("...+5infoSuspicious file in repoExecutable file (smoke-windows.ps1) in repositoryscripts/ci/smoke-windows.ps1+2
infoSuspicious file in repoVery large source file (515KB) — could contain obfuscated payloadsrc/crates/concat/src/studio.rs+2
Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.
270 files scanned @ 797c8c7 | 10/22/2026 | heuristic scan — always review manually
risk by category
code execution25
network & exfiltration5
file system access0
obfuscation0
supply chain4
owasp / injection0
telemetry
files 270/1215rules hit 11engine v7commit 797c8c7
github
jub0t/concat
The truly free, open-source, local-first, cross-platform CapCut replacement. Scriptable through a JSON-RPC API & MCP.
10823
1314
64d
1215 files
270 scanned(22%)
797c8c7
architecture░▒▓
entry (0) flagged (34) pkg (271)
500 nodes · 561 edgesscroll to zoom · click node to jump to finding