live · scanning repos
Scanrepo
github.com
github.com / stablyai

stablyai/orca

TypeScript·29382 files·commit f559c05·scanned 1h ago·cached ✓
15/100
LOW RISK
Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 15 — 77,665+ stars — findings likely false positives

verdict accurate?
77,665 stars
Crypto/Web3 project
10% file coverage
Partial architecture graph
threat-state: lowlive

FINDINGS ░▒▓

criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.cloud/apps/push/src/push-deploy-preflight.test.ts
  expect(script).toBeDefined()
  const run = new Function('loadPushConfig', script!.replace(/import .*?;/, ''))
  expect(() => run(loadPushConfig)).not.toThrow()
  expect(() => run(() => ({ mode: 'act...
+5
criticalchild_process / exec usageExecuting shell commands can be used to download and run malware, exfiltrate data, or modify system files.config/docker/daemon-scope-lifetime/run-cases.cjs
  scopes.push(unit)
  const runtime = spawn(
    process.execPath,
    [fixture, 'runtime', resultPath, bundlePath, nonce, ownership],
+8
criticalchild_process / exec usageExecuting shell commands can be used to download and run malware, exfiltrate data, or modify system files.config/docker/daemon-shutdown-descendants/fixture.cjs
  let output = ''
  const canary = spawn('/bin/sh', ['-c', 'while :; do sleep 1; done'], {
    stdio: 'ignore'
  })
+8
criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.config/scripts/command-code-transcript-scan-benchmark.mjs
  }
  const value = Number(new Function(`return (${match[1]})`)())
  if (!Number.isInteger(value) || value <= 0) {
    throw new Error(`${name} did not resolve to a positive integer`)
+5
criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.config/scripts/mobile-web-app-route-manifest.test.mjs
  const build = (modules) =>
    new Function('modules', `${ROUTE_CONTEXT_SOURCE}; return routeContext`)(modules)

  it('answers the four members expo-router reads', () => {
+5
infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2
infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.cloud/dev/scripts/smoke-relay.mjs
const plaintext = nacl.box.open(
  Buffer.from(challenge.ciphertextB64, 'base64'),
  Buffer.from(challenge.nonceB64, 'base64'),
  Buffer.from(challenge.relayEphemeralPublicKeyB64, 'base64'),
+2
infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.mobile/src/mock-server-key-pair.test.ts
    const malformed = `${encoded.slice(0, 4)}!${encoded.slice(4)}`
    expect(Buffer.from(malformed, 'base64')).toHaveLength(nacl.box.secretKeyLength)
    writeFileSync(keyFile, malformed)
    const l...
+2
warningSeed phrase / private key harvesting UICollects seed phrase, private key, or mnemonic from the user via input/textarea/clipboard/prompt. Wallet drainers and fake wallet apps use this to steal funds.cloud/apps/relay/src/relay-connection-hard-cap.blackbox.test.ts
      .setExpirationTime('5m')
      .sign(adminKeys.privateKey)
    const statusResponse = await fetch(`${relayUrl}/v1/admin/runtime-status`, {
      method: 'POST',
+5
warningSeed phrase / private key harvesting UICollects seed phrase, private key, or mnemonic from the user via input/textarea/clipboard/prompt. Wallet drainers and fake wallet apps use this to steal funds.cloud/apps/relay/src/relay.blackbox.test.ts
let issuer: string
let privateKey: Awaited<ReturnType<typeof generateKeyPair>>['privateKey']
let adminPrivateKey: Awaited<ReturnType<typeof generateKeyPair>>['privateKey']
let relayDataDirectory: stri...
+5
criticalSecret collection in crypto contextCollects seed phrases, private keys, or clipboard content while also targeting browser wallets. This is a wallet-stealer pattern.+10
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.cloud/package.json+4
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.config/relay-assets/node-pty-1.1.0-windows-pty-teardown-patch.cjs+4
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.electron.vite.config.ts+3
warningHigh-entropy string literalsFound 12 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.cloud/apps/relay-ops/public/app.js+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.cloud/apps/relay-ops/public/app.js+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.cloud/apps/relay/src/app.ts+3
warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.cloud/apps/push/src/device-registration-delete-race.test.ts+3
warningHigh-entropy string literalsFound 6 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.cloud/apps/push/src/device-registry-store.ts+3
warningLarge base64-encoded blobA 96-character base64 blob was found. May hide a remote payload or encoded executable code.mobile/src/files/mobile-diff-image-preview.test.ts
iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8...
+3
warningLarge base64-encoded blobA 96-character base64 blob was found. May hide a remote payload or encoded executable code.mobile/src/files/mobile-file-tab-doc.test.ts
iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8...
+3
infoSuspicious file in repoExecutable file (setup.ps1) in repository.github/actions/setup-wsl-test-runtime/setup.ps1+2
infoSuspicious file in repoVery large source file (638KB) — could contain obfuscated payloadconfig/scripts/ci-shard-timings.json+2
infoSuspicious file in repoVery large source file (574KB) — could contain obfuscated payloadmobile/rpc-foundation/pilot-scenarios.json+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

2988 files scanned @ f559c05 | 9/25/2026 | heuristic scan — always review manually

risk by category
code execution25
network & exfiltration4
file system access20
obfuscation15
supply chain15
owasp / injection0
telemetry
files 2988/29382rules hit 24engine v6commit f559c05

github

stablyai/orca

Orca is the ADE for working with a fleet of parallel agents. Run any coding agent with your own subscription. Available on desktop, mobile and remote runtime.

TypeScript
77665
5083
192d
29382 files
2988 scanned(10%)
f559c05

architecture░▒▓

entry (1) flagged (304) pkg (48)
448 nodes · 906 edgesscroll to zoom · click node to jump to finding