live · scanning repos
Scanrepo
github.com
github.com / qybaihe

qybaihe/bla

TypeScript·200 files·commit b2d6436·scanned 19h ago·cached ✓
40/100
SUSPICIOUS
Obfuscation or dynamic code paths detected. Intent unclear — review before running anything.
verdict accurate?
Created 5 days ago
Created in the last 7 days
Research / educational context
CLI tool detected
threat-state: suspiciouslive

FINDINGS ░▒▓

what this code does░▒▓

What happens when you open, install or run it, from the findings below.

  1. when runsrc/engine/benchmark.ts builds code from strings at run time with the vm module. src/engine/benchmark.ts
warningVM code executionvm.runInNewContext or similar can execute arbitrary code in a sandboxed context that may be escaped.src/engine/benchmark.ts
  };
  vm.runInNewContext(code, sandbox, { timeout: 5000 });
  return mod.exports;
}
+4
criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.tests/exhaustion-suite.test.ts
    expect(nameMatch).not.toBeNull();
    const fn = new Function(`${flood.code}; return typeof ${nameMatch![1]} === "function";`);
    expect(fn).not.toThrow();
  });
+5
criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.tests/runtime-memory-diff-shield.test.ts

    const readerFn = new Function(
      "shareA",
      "shareB",
+5
criticalSuspicious code is reachable from an entry pointFlagged files are imported by the application's entry path: src/engine/benchmark.ts. This means the suspicious code can execute when the app runs.+8
infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2
warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.src/shields/deception/cognitive-armor-trigger.ts+3
infoSuspicious file in repoVery large source file (2991KB) — could contain obfuscated payloaddocs/redteam/empirical-rea-validation.json+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

130 files scanned @ b2d6436 | 10/30/2026 | heuristic scan — always review manually

risk by category
code execution24
network & exfiltration0
file system access0
obfuscation3
supply chain2
owasp / injection0
telemetry
files 130/200rules hit 7engine v10commit b2d6436

github

qybaihe/bla

🛡️ BLA (Blind LLM Agents) — Adversarial defense shield that protects binaries, Electron apps, JS bundles, Python, and WebAssembly against AI reverse-engineering agents like REA. Poison -> Exhaust -> Hallucinate.

TypeScript
790
127
6d
200 files
130 scanned(65%)
b2d6436

network indicators░▒▓

Hosts this code names or would connect to. 27 found, decoded and call-site destinations first. Informational, not scored.

architecture░▒▓

entry (1) flagged (4) pkg (12)
138 nodes · 545 edgesscroll to zoom · click node to jump to finding
SUSPICIOUS (40/100) — qybaihe/bla — ScanRepo