github.com / nextcloud

nextcloud/server

PHP·14258 files·commit 9cabd07·scanned 5d ago·cached ✓

15/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 15 — 37,233+ stars — findings likely false positives

verdict accurate?

37,233 stars

1% file coverage

threat-state: lowlive

FINDINGS ░▒▓

infoSuspicious file in repoVery large source file (616KB) — could contain obfuscated payloadcore/openapi-full.json+2

infoSuspicious file in repoVery large source file (2149KB) — could contain obfuscated payloadopenapi.json+2

infoSuspicious file in repoVery large source file (580KB) — could contain obfuscated payloadpackage-lock.json+2

warningPossible typosquat: vuex"vuex" is only 1 character(s) away from the popular package "vue". This is a common supply-chain attack vector.package.json+4

warningDependency runs install scripts"<root>/postinstall" executes code during installation. Malicious packages use this to drop payloads before the app even runs.package.json+3

infoAuthor has no other public repositoriesGitHub user "dependabot[bot]" has no other public repositories, common for burner accounts used in scams.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

120 files scanned @ 9cabd07 | 10/22/2026 | heuristic scan — always review manually

risk by category

code execution0

network & exfiltration0

file system access0

obfuscation0

supply chain15

owasp / injection0

telemetry

files 120/14258rules hit 6engine v7commit 9cabd07

github

nextcloud/server

☁️ Nextcloud server, a safe home for all your data

PHP

37233

5299

3800d

14258 files

120 scanned(1%)

9cabd07

architecture░▒▓

entry (0) flagged (0) pkg (47)

166 nodes · 382 edgesscroll to zoom · click node to jump to finding