github.com / nkaz001

nkaz001/hftbacktest

Rust·232 files·commit 5f3ec40·scanned 1h ago·cached ✓

25/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 25 — 4,776 stars — findings likely legitimate code patterns

verdict accurate?

Crypto/Web3 project

Research / educational context

threat-state: lowlive

FINDINGS ░▒▓

warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.hftbacktest/src/backtest/data/mod.rs

        let byte_len = size_of_val(data);
        let bytes = unsafe { std::slice::from_raw_parts(data.as_ptr() as *const u8, byte_len) };

        let dest_data_ptr = DataPtr::new(byte_len);


    let data = unsafe { Data::from_data_ptr(buf, 10 + header_len) };
    Ok(data)
}

        let mut evst_no = 0;
        let mut timestamp = unsafe { *self.timestamp.get_unchecked(0) };
        for (i, &ev_timestamp) in self.timestamp[1..].iter().enumerate() {
            if ev_times...

warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.hftbacktest/examples/5_backtest.py

    )
    return_code = subprocess.call(cmd, shell=True)
    print(f'{symbol}: {return_code}\n')

    )
    return_code = subprocess.call(cmd, shell=True)
    print(f'{symbol}: {return_code}\n')

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.connector/src/binancefutures/rest.rs

    },
    utils::sign_hmac_sha256,
};

    },
    utils::sign_ed25519,
};

    },
    utils::sign_hmac_sha256,
};

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.py-hftbacktest/hftbacktest/data/utils/binancefutures.py+4

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.py-hftbacktest/hftbacktest/data/utils/hyperliquid.py+4

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

130 files scanned @ 5f3ec40 | 9/25/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration15

file system access0

obfuscation8

supply chain0

owasp / injection0

telemetry

files 130/232rules hit 11engine v6commit 5f3ec40

github

nkaz001/hftbacktest

Free, open source, a high frequency trading and market making backtesting and trading bot, which accounts for limit orders, queue positions, and latencies, utilizing full tick data for trades and order books(Level-2 and Level-3), with real-world crypto trading examples for Binance and Bybit

Rust

4776

914

1492d

232 files

130 scanned(56%)

5f3ec40

architecture░▒▓

entry (0) flagged (23) pkg (82)

210 nodes · 367 edgesscroll to zoom · click node to jump to finding