DANGER

malware detected

github.com / rootdr-backup

rootdr-backup/Reconner

Go·632 files·commit 805e553·scanned 22h ago·cached ✓

70/100

DANGEROUS

Sensitive capability combinations reachable from entry points. Do not run without review.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?

Partial architecture graph

threat-state: dangerouslive

FINDINGS ░▒▓

criticalGo os/exec usageos/exec is used to run external commands. In malware it drops payloads, modifies the system, or opens shells.internal/api/tool_install.go

		}
		c := exec.CommandContext(ctx, "go", "install", s.Ref) // #nosec G204 -- s.Ref comes only from the compile-time allowlisted tool catalog
		c.Env = append(os.Environ(),
			"GOBIN="+h.cfg.ToolsDir,

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.internal/scanner/dom_xss_test.go

		`box.streamHTMLUnsafe().getWriter().write(location.hash);`,
		`const tag=document.createElement(location.hash.slice(1));eval(tag.localName);`,
		`const saved=localStorage.getItem("draft");box.innerH...

criticalGo os/exec usageos/exec is used to run external commands. In malware it drops payloads, modifies the system, or opens shells.internal/scanner/nuclei_pack_quality_test.go

		defer cancel()
		cmd := exec.CommandContext(ctx, bin, "-u", server.URL, "-t", template, "-jsonl", "-silent", "-duc", "-nc") // #nosec G204 -- fixed local test arguments
		out, err := cmd.CombinedOut...

warningGo unsafe package usageunsafe package bypasses Go's type safety. Malware uses it for memory tricks, pointer casts, and hiding behavior.internal/scanner/paramfuzz.go

	"log", "logs", "trace", "verbose", "output", "response", "result", "error",
	"internal", "private", "public", "hidden", "secure", "unsafe", "raw",
}

criticalGo os/exec usageos/exec is used to run external commands. In malware it drops payloads, modifies the system, or opens shells.internal/scanner/xss_browser.go

	defer cancel()
	cmd := exec.CommandContext(ctx, path, "--version") // #nosec G702 -- operator-selected browser path is executed without a shell and with one fixed argument
	cmd.Stdout, cmd.Stderr = i...

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.internal/scanner/xss_payloads.go

		{`<svg onload=window['al'+'ert'](document.domain)>`, "svg", "onload"},
		{`<svg onload=eval(atob('YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ=='))>`, "svg", "eval("},
		// fromCharCode spells "alert" from numeri...

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.internal/scanner/xss_payloads_test.go

		if !strings.Contains(low, "alert(") && !strings.Contains(low, "confirm(") &&
			!strings.Contains(low, "print()") && !strings.Contains(low, "eval(") &&
			!strings.Contains(low, "document.domain") {...

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningHardcoded IP address in network callFetching data from hardcoded IP addresses instead of domain names is suspicious and may indicate C2 communication.internal/scanner/ssrf.go

// live in our payload URL, so any endpoint that merely reflects the parameter
// (e.g. "Redirecting to http://169.254.169.254/.../iam/security-credentials/")
// would match them and produce a false "...

warningGo net/http with hardcoded IPHardcoded public IP addresses in HTTP clients are common in malware C2 configurations.internal/scanner/ssrf.go

// live in our payload URL, so any endpoint that merely reflects the parameter
// (e.g. "Redirecting to http://169.254.169.254/.../iam/security-credentials/")
// would match them and produce a false "...

warningHardcoded IP address in network callFetching data from hardcoded IP addresses instead of domain names is suspicious and may indicate C2 communication.internal/scanner/vulnengine_upgrade_test.go

	// Reflection guard: the new host/path markers must still catch payload echo.
	if !responseReflectsPayload("Redirecting to http://100.100.100.200/latest/meta-data/", "http://100.100.100.200/latest/me...

warningGo net/http with hardcoded IPHardcoded public IP addresses in HTTP clients are common in malware C2 configurations.internal/scanner/vulnengine_upgrade_test.go

	// Reflection guard: the new host/path markers must still catch payload echo.
	if !responseReflectsPayload("Redirecting to http://100.100.100.200/latest/meta-data/", "http://100.100.100.200/latest/me...

infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.internal/scanner/xss_payloads.go

		{`<svg onload=window['al'+'ert'](document.domain)>`, "svg", "onload"},
		{`<svg onload=eval(atob('YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ=='))>`, "svg", "eval("},
		// fromCharCode spells "alert" from numeri...

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.frontend/src/components/GuidedCorpus.tsx+4

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.frontend/src/pages/GuidedAnalyze.tsx+4

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.frontend/src/components/GuidedCorpus.tsx+3

infoAuthor has no other public repositoriesGitHub user "claude" has no other public repositories, common for burner accounts used in scams.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

501 files scanned @ 805e553 | 10/28/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration20

file system access0

obfuscation15

supply chain2

owasp / injection0

telemetry

files 501/632rules hit 19engine v7commit 805e553

github

rootdr-backup/Reconner

Self-hosted bug-bounty platform — verification-first recon & DAST, continuous monitoring. Your data stays on your machine.

134

83d

632 files

501 scanned(79%)

805e553

architecture░▒▓

entry (1) flagged (14) pkg (106)

506 nodes · 1683 edgesscroll to zoom · click node to jump to finding