github.com / mgth

mgth/littlebigmouse

C#·1063 files·commit 2b8946a·scanned 2h ago·cached ✓

25/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 25 — 6,640 stars — findings likely legitimate code patterns

verdict accurate?

30% file coverage

threat-state: lowlive

FINDINGS ░▒▓

warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.rust/crates/lbm-agent/src/elevation.rs

                    // SAFETY (Rust 2024): before any thread of this agent is started.
                    unsafe { std::env::set_var(name, value) };
                }
                false

criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.rust/crates/lbm-agent/src/gap_guard.rs

pub fn run_kscreen_doctor(args: &[String]) -> bool {
    match Command::new("kscreen-doctor")
        .args(args)
        .stdin(Stdio::null())

            None => {
                std::env::temp_dir().join(format!("lbm-agent-{}.lock", unsafe { libc::getuid() }))
            }
        }

    // SAFETY: both descriptors are valid; dup2 makes 2 a copy of the log's.
    if unsafe { libc::dup2(file.as_raw_fd(), libc::STDERR_FILENO) } == -1 {
        return Err(io::Error::last_os_error());...

        // one already runs (its single-instance guard).
        match std::process::Command::new(ui)
            .stdin(std::process::Stdio::null())
            .spawn()

    const CREATE_NO_WINDOW: u32 = 0x0800_0000;
    let output = std::process::Command::new("schtasks.exe")
        .args(args)
        .creation_flags(CREATE_NO_WINDOW)

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

infoSuspicious file in repoExecutable file (run-lbm.ps1) in repositoryrun-lbm.ps1+2

infoSuspicious file in repoExecutable file (stage.ps1) in repositoryrust/crates/lbm-hook/stage.ps1+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

318 files scanned @ 2b8946a | 9/25/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration0

file system access0

obfuscation0

supply chain4

owasp / injection0

telemetry

files 318/1063rules hit 9engine v6commit 2b8946a

github

mgth/littlebigmouse

DPI Aware mouse move across screens

6640

284

4248d

1063 files

318 scanned(30%)

2b8946a

architecture░▒▓

entry (0) flagged (32) pkg (186)

395 nodes · 493 edgesscroll to zoom · click node to jump to finding