DANGER

malware detected

github.com / staccDOTsol

staccDOTsol/openzoo

JavaScript·82 files·commit 62d9a36·scanned 5d ago·cached ✓

100/100

MALICIOUS

the repository provides a local proxy for openai-compatible tools and handles payment through a burner wallet, with no indication of targeting victims or collecting user secrets. the findings are related to wallet operations and subprocess execution, which are necessary for its functionality.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?

Created 5 days ago

Crypto/Web3 project

Created in the last 7 days

CLI tool detected

threat-state: maliciouslive

FINDINGS ░▒▓

criticalchild_process / exec usageExecuting shell commands can be used to download and run malware, exfiltrate data, or modify system files.lib/cursorbackend.js

  const san = `subjectAltName=${TLS_HOSTS.map((h) => `DNS:${h}`).join(',')}`;
  execFileSync('openssl', [
    'req', '-x509', '-newkey', 'rsa:2048', '-nodes',
    '-keyout', key, '-out', cert, '-days'...

criticalchild_process / exec usageExecuting shell commands can be used to download and run malware, exfiltrate data, or modify system files.lib/hosts.js

  if (WIN) return false;
  const r = spawnSync('sudo', ['sh', '-c', unixLine], { stdio: 'inherit' });
  return r.status === 0;
}

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

infoLLM: classified as security tool / researchAI analysis classified this repo as a security tool, POC, or research project with high confidence. It may implement dangerous capabilities, but the stated intent appears legitimate. the repository provides a local proxy for openai-compatible tools and handles payment through a burner wallet, with no indication of targeting victims or collecting user secrets. the findings are related to wallet operations and subprocess execution, which are necessary for its functionality.+0

criticalCryptocurrency wallet directory accessAccessing wallet directories to steal private keys, seed phrases, or wallet data.lib/wallet.js+5

criticalCryptocurrency wallet directory accessAccessing wallet directories to steal private keys, seed phrases, or wallet data.scripts/move-wrapped.mjs+5

criticalCryptocurrency wallet directory accessAccessing wallet directories to steal private keys, seed phrases, or wallet data.scripts/wrap-leos.mjs+5

warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.lib/boxes.js

  'bash', '-lc',
  'set +e; mkdir -p /workspace /root/.openzoo /var/log/openzoo /run/sshd /root/.ssh; '
  + 'if [ -n "$OPENZOO_WALLET_JSON" ]; then printf %s "$OPENZOO_WALLET_JSON" > /root/.openzoo/wa...

warningHigh-entropy string literalsFound 13 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.lib/setup.js+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.lib/setup.js+3

warningHigh-entropy string literalsFound 6 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.scripts/move-wrapped.mjs+3

warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.scripts/paylatency.mjs+3

warningLarge base64-encoded blobA 88-character base64 blob was found. May hide a remote payload or encoded executable code.scripts/wrapdisc4.mjs

27oQVtfbFiXVB8dR2P62f3ShAXyQJmm7rG7qjcVDNnvGmqHqr7cX4HSdhSuC...

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.scripts/wrapdisc4.mjs+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.bin/openzoo.js+3

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

61 files scanned @ 62d9a36 | 8/19/2026 | heuristic scan — always review manually

risk by category

code execution18

network & exfiltration0

file system access20

obfuscation15

supply chain0

owasp / injection0

llm second opinion

LLM: classified as security tool / research

AI analysis classified this repo as a security tool, POC, or research project with high confidence. It may implement dangerous capabilities, but the stated intent appears legitimate. the repository provides a local proxy for openai-compatible tools and handles payment through a burner wallet, with no indication of targeting victims or collecting user secrets. the findings are related to wallet operations and subprocess execution, which are necessary for its functionality.

confidence high · informs the score, does not decide it

telemetry

files 61/82rules hit 15engine v5commit 62d9a36

github

staccDOTsol/openzoo

Local x402-paying proxy + MCP server for openzoo.fun — any OpenAI-compatible harness, no crypto knowledge needed

JavaScript

11d

82 files

61 scanned(74%)

62d9a36

architecture░▒▓

entry (0) flagged (36) pkg (13)

68 nodes · 144 edgesscroll to zoom · click node to jump to finding