github.com / raphire
raphire/
PowerShell·403 files·commit f431c56·scanned 3d ago·cached ✓
15/100
LOW RISK
Minor findings consistent with the project type. Nothing reachable from install hooks.
score capped at 15 — 56,281+ stars — findings likely false positives
verdict accurate?
56,281 stars
4% file coverage
Research / educational context
threat-state: lowlive
FINDINGS ░▒▓
warningSuspicious Windows batch commandBatch file contains commands commonly used to download and execute remote payloads (powershell, certutil, bitsadmin, curl to pipe, etc.).Run.bat
call :Log Launching Win11Debloat.ps1 with Windows Terminal...
PowerShell -NoProfile -ExecutionPolicy Bypass -Command "$p='%SCRIPT_PATH:'=''%'; $w='%wtPath:'=''%'; $q=[char]34; Start-Process -F...+5infoSuspicious file in repoExecutable file (Get-WingetInstalledApps.ps1) in repositoryScripts/AppRemoval/Get-WingetInstalledApps.ps1+2
infoSuspicious file in repoExecutable file (Invoke-ForceRemoveEdge.ps1) in repositoryScripts/AppRemoval/Invoke-ForceRemoveEdge.ps1+2
Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.
16 files scanned @ f431c56 | 8/26/2026 | heuristic scan — always review manually
risk by category
code execution5
network & exfiltration0
file system access0
obfuscation0
supply chain15
owasp / injection0
telemetry
files 16/403rules hit 4engine v5commit f431c56
github
raphire/win11debloat
A simple, lightweight PowerShell script that allows you to remove pre-installed apps, disable telemetry, as well as perform various other changes to declutter and customize your Windows experience. Win11Debloat works for both Windows 10 and Windows 11.
56281
2395
2132d
403 files
16 scanned(4%)
f431c56
architecture░▒▓
No architecture graph available. This usually happens when the repo contains no scannable JS/TS/Python files or only a single file was analyzed.