github.com / raphire

raphire/win11debloat

PowerShell·474 files·commit 535a1d8·scanned 3d ago·cached ✓

15/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 15 — 60,861+ stars — findings likely false positives

verdict accurate?

60,861 stars

16% file coverage

Research / educational context

threat-state: lowlive

FINDINGS ░▒▓

warningSuspicious Windows batch commandBatch file contains commands commonly used to download and execute remote payloads (powershell, certutil, bitsadmin, curl to pipe, etc.).Run.bat

    call :Log Launching Win11Debloat.ps1 with Windows Terminal...
    PowerShell -NoProfile -ExecutionPolicy Bypass -Command "$p='%SCRIPT_PATH:'=''%'; $w='%wtPath:'=''%'; $q=[char]34; Start-Process -F...

infoSuspicious file in repoExecutable file (Run.bat) in repositoryRun.bat+2

infoSuspicious file in repoExecutable file (Get-WingetInstalledApps.ps1) in repositoryScripts/AppRemoval/Get-WingetInstalledApps.ps1+2

infoSuspicious file in repoExecutable file (Invoke-ForceRemoveEdge.ps1) in repositoryScripts/AppRemoval/Invoke-ForceRemoveEdge.ps1+2

infoAuthor has no other public repositoriesGitHub user "dependabot[bot]" has no other public repositories, common for burner accounts used in scams.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

74 files scanned @ 535a1d8 | 10/26/2026 | heuristic scan — always review manually

risk by category

code execution5

network & exfiltration0

file system access0

obfuscation0

supply chain15

owasp / injection0

telemetry

files 74/474rules hit 5engine v7commit 535a1d8

github

raphire/win11debloat

A simple, lightweight PowerShell script that allows you to remove pre-installed apps, disable telemetry, as well as perform various other changes to declutter and customize your Windows experience. Win11Debloat works for both Windows 10 and Windows 11.

PowerShell

60861

2681

2193d

474 files

74 scanned(16%)

535a1d8

architecture░▒▓

No architecture graph available. This usually happens when the repo contains no scannable JS/TS/Python files or only a single file was analyzed.