DANGER
malware detected
github.com / lucacadalora
lucacadalora/
Rust·510 files·commit 08565c0·scanned 3d ago·cached ✓
70/100
DANGEROUS
Sensitive capability combinations reachable from entry points. Do not run without review.
This repository contains patterns associated with malware. Do NOT run this code.
verdict accurate?
Created 2 days ago
Created in the last 7 days
43% file coverage
threat-state: dangerouslive
FINDINGS ░▒▓
warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.crates/poni/src/app.rs
unsafe {
let _ = SetProcessDpiAwarenessContext(DPI_AWARENESS_CONTEXT_PER_MONITOR_AWARE_V2);
}+3warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.crates/poni/src/autostart.rs
let spawned = std::thread::Builder::new().name("autostart".into()).spawn(move || {
let hr = unsafe { CoInitializeEx(None, COINIT_MULTITHREADED) };
if let Some(on) = set {
...+3warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.crates/poni/src/clock.rs
pub fn local_now() -> LocalDateTime {
let st = unsafe { GetLocalTime() };
LocalDateTime {
year: st.wYear as i32,+3criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.crates/poni/src/mac/app.rs
self.st.cmds.push(Command::SaveSettings);
match std::env::current_exe().and_then(|exe| std::process::Command::new(exe).args(["--full-screen-window", "90"]).spawn()) {
...+8criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.crates/poni/src/mac/services/media.rs
fn osascript(script: &str) -> Result<String, String> {
let mut child = Command::new("/usr/bin/osascript")
.arg("-e")
.arg(script)+8criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.crates/poni/src/services/update.rs
}
std::process::Command::new(setup).args(["/S", "/reopen"]).spawn().map(drop).map_err(|e| e.to_string())
}
+8warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.crates/poni-core/src/ttml.rs+4
infoSuspicious file in repoExecutable file (ci-fake-music.ps1) in repositorytools/ci-fake-music.ps1+2
Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.
217 files scanned @ 08565c0 | 10/26/2026 | heuristic scan — always review manually
risk by category
code execution25
network & exfiltration0
file system access0
obfuscation4
supply chain14
owasp / injection0
telemetry
files 217/510rules hit 11engine v7commit 08565c0
github
lucacadalora/oyenza-studio
Oyenza Studio (formerly Oyen Poni): a living notch (Dynamic Island) for Windows and Mac. Music with synced lyrics, a focus timer, a file shelf your phone can drop into, tasks, clipboard history and live system stats. Native Rust, free and open source.
55
10
6d
510 files
217 scanned(43%)
08565c0
architecture░▒▓
entry (0) flagged (54) pkg (248)
452 nodes · 700 edgesscroll to zoom · click node to jump to finding