github.com / khan-rustam

khan-rustam/CryptoSkope-task

TypeScript·161 files·commit d11560d·scanned 5d ago·cached ✓

41/100

SUSPICIOUS

Obfuscation or dynamic code paths detected. Intent unclear — review before running anything.

verdict accurate?

Created 0 days ago

No stars or forks

Created in the last 7 days

No community activity

threat-state: suspiciouslive

FINDINGS ░▒▓

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

infoBrowser wallet provider accessAccesses browser wallet providers (window.solana, window.ethereum, Phantom, Solflare, etc.). Common in Web3 apps but also the entry point for wallet drainers.lib/wallet/metamask.ts

 *
 * This module is the only place in the app that touches `window.ethereum`.
 * Everything above it (the React context, the components) works with plain
 * values and `WalletError`s, which keeps the...

 * `window` is assigned directly rather than pulling in jsdom: this module only
 * ever reads `window.ethereum`, so a full DOM would be dead weight.
 */
function fakeWallet(overrides: Record<string, u...

warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.app/login/page.tsx+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.components/market-stats.tsx+3

warningHigh-entropy string literalsFound 5 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.components/ui/chart.tsx+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.components/ui/chart.tsx+3

warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.components/ui/toast.tsx+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.lib/api/rss.ts+3

warningDependency runs install scripts"<root>/postinstall" executes code during installation. Malicious packages use this to drop payloads before the app even runs.package.json+3

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

139 files scanned @ d11560d | 8/19/2026 | heuristic scan — always review manually

risk by category

code execution2

network & exfiltration0

file system access4

obfuscation15

supply chain3

owasp / injection0

telemetry

files 139/161rules hit 10engine v5commit d11560d

github

khan-rustam/CryptoSkope-task

TypeScript

161 files

139 scanned(86%)

d11560d

architecture░▒▓

entry (2) flagged (5) pkg (121)

256 nodes · 411 edgesscroll to zoom · click node to jump to finding