github.com / rootscripts

rootscripts/riff

JavaScript·70 files·commit bd725ed·scanned 3d ago·cached ✓

8/100

SAFE

No malicious patterns found. Repo signals are consistent with a legitimate project.

verdict accurate?

Created 21 days ago

Research / educational context

CLI tool detected

threat-state: safelive

FINDINGS ░▒▓

infoSuspicious file in repoVery large source file (604KB) — could contain obfuscated payloadassets/hls.min.js+2

infoSuspicious file in repoVery large source file (880KB) — could contain obfuscated payloadsrc/renderer/app.js+2

infoAuthor has no other public repositoriesGitHub user "github-actions[bot]" has no other public repositories, common for burner accounts used in scams.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

27 files scanned @ bd725ed | 10/25/2026 | heuristic scan — always review manually

risk by category

code execution0

network & exfiltration0

file system access0

obfuscation0

supply chain6

owasp / injection0

telemetry

files 27/70rules hit 3engine v7commit bd725ed

github

rootscripts/riff

Your best desktop music player.

JavaScript

503

25d

70 files

27 scanned(39%)

bd725ed

architecture░▒▓

entry (2) flagged (0) pkg (5)

29 nodes · 25 edgesscroll to zoom · click node to jump to finding