github.com / stablyai
stablyai/ orca
TypeScript·29382 files·commit f559c05·scanned 1h ago·cached ✓
15/100
LOW RISK
Minor findings consistent with the project type. Nothing reachable from install hooks.
score capped at 15 — 77,665+ stars — findings likely false positives
verdict accurate?
77,665 stars
Crypto/Web3 project
10% file coverage
Partial architecture graph
threat-state: lowlive
FINDINGS ░▒▓
criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.cloud/apps/push/src/push-deploy-preflight.test.ts
expect(script).toBeDefined()
const run = new Function('loadPushConfig', script!.replace(/import .*?;/, ''))
expect(() => run(loadPushConfig)).not.toThrow()
expect(() => run(() => ({ mode: 'act...+5criticalchild_process / exec usageExecuting shell commands can be used to download and run malware, exfiltrate data, or modify system files.config/docker/daemon-scope-lifetime/run-cases.cjs
scopes.push(unit)
const runtime = spawn(
process.execPath,
[fixture, 'runtime', resultPath, bundlePath, nonce, ownership],+8criticalchild_process / exec usageExecuting shell commands can be used to download and run malware, exfiltrate data, or modify system files.config/docker/daemon-shutdown-descendants/fixture.cjs
let output = ''
const canary = spawn('/bin/sh', ['-c', 'while :; do sleep 1; done'], {
stdio: 'ignore'
})+8criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.config/scripts/command-code-transcript-scan-benchmark.mjs
}
const value = Number(new Function(`return (${match[1]})`)())
if (!Number.isInteger(value) || value <= 0) {
throw new Error(`${name} did not resolve to a positive integer`)+5criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.config/scripts/mobile-web-app-route-manifest.test.mjs
const build = (modules) =>
new Function('modules', `${ROUTE_CONTEXT_SOURCE}; return routeContext`)(modules)
it('answers the four members expo-router reads', () => {+5infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.cloud/dev/scripts/smoke-relay.mjs
const plaintext = nacl.box.open( Buffer.from(challenge.ciphertextB64, 'base64'), Buffer.from(challenge.nonceB64, 'base64'), Buffer.from(challenge.relayEphemeralPublicKeyB64, 'base64'),+2
infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.mobile/src/mock-server-key-pair.test.ts
const malformed = `${encoded.slice(0, 4)}!${encoded.slice(4)}`
expect(Buffer.from(malformed, 'base64')).toHaveLength(nacl.box.secretKeyLength)
writeFileSync(keyFile, malformed)
const l...+2warningSeed phrase / private key harvesting UICollects seed phrase, private key, or mnemonic from the user via input/textarea/clipboard/prompt. Wallet drainers and fake wallet apps use this to steal funds.cloud/apps/relay/src/relay-connection-hard-cap.blackbox.test.ts
.setExpirationTime('5m')
.sign(adminKeys.privateKey)
const statusResponse = await fetch(`${relayUrl}/v1/admin/runtime-status`, {
method: 'POST',+5warningSeed phrase / private key harvesting UICollects seed phrase, private key, or mnemonic from the user via input/textarea/clipboard/prompt. Wallet drainers and fake wallet apps use this to steal funds.cloud/apps/relay/src/relay.blackbox.test.ts
let issuer: string let privateKey: Awaited<ReturnType<typeof generateKeyPair>>['privateKey'] let adminPrivateKey: Awaited<ReturnType<typeof generateKeyPair>>['privateKey'] let relayDataDirectory: stri...+5
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.cloud/package.json+4
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.config/relay-assets/node-pty-1.1.0-windows-pty-teardown-patch.cjs+4
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.electron.vite.config.ts+3
warningHigh-entropy string literalsFound 12 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.cloud/apps/relay-ops/public/app.js+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.cloud/apps/relay-ops/public/app.js+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.cloud/apps/relay/src/app.ts+3
warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.cloud/apps/push/src/device-registration-delete-race.test.ts+3
warningHigh-entropy string literalsFound 6 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.cloud/apps/push/src/device-registry-store.ts+3
warningLarge base64-encoded blobA 96-character base64 blob was found. May hide a remote payload or encoded executable code.mobile/src/files/mobile-diff-image-preview.test.ts
iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8...+3
warningLarge base64-encoded blobA 96-character base64 blob was found. May hide a remote payload or encoded executable code.mobile/src/files/mobile-file-tab-doc.test.ts
iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8...+3
infoSuspicious file in repoExecutable file (setup.ps1) in repository.github/actions/setup-wsl-test-runtime/setup.ps1+2
infoSuspicious file in repoVery large source file (638KB) — could contain obfuscated payloadconfig/scripts/ci-shard-timings.json+2
infoSuspicious file in repoVery large source file (574KB) — could contain obfuscated payloadmobile/rpc-foundation/pilot-scenarios.json+2
Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.
2988 files scanned @ f559c05 | 9/25/2026 | heuristic scan — always review manually
risk by category
code execution25
network & exfiltration4
file system access20
obfuscation15
supply chain15
owasp / injection0
telemetry
files 2988/29382rules hit 24engine v6commit f559c05
github
stablyai/orca
Orca is the ADE for working with a fleet of parallel agents. Run any coding agent with your own subscription. Available on desktop, mobile and remote runtime.
77665
5083
192d
29382 files
2988 scanned(10%)
f559c05
architecture░▒▓
entry (1) flagged (304) pkg (48)
448 nodes · 906 edgesscroll to zoom · click node to jump to finding