github.com / sxyazi

sxyazi/yazi

Rust·1408 files·commit 9129ffd·scanned 12d ago·cached ✓

15/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 15 — 41,652+ stars — findings likely false positives

verdict accurate?

41,652 stars

Partial architecture graph

threat-state: lowlive

FINDINGS ░▒▓

warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.yazi-actor/src/lives/file.rs

		Ok(
			match unsafe { (*FILE_CACHE.get()).assume_init_mut() }.entry(PtrCell(&folder.entries[idx])) {
				Entry::Occupied(oe) => oe.into_mut().clone(),
				Entry::Vacant(ve) => {

		defer! {
			unsafe {
				(*FILE_CACHE.get()).assume_init_mut().clear();
				for ud in (*TO_DESTROY.get()).drain(..) {

pub(super) fn init() {
	unsafe { FILE_CACHE.get().write(std::mem::MaybeUninit::new(<_>::default())) };
}

criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.yazi-adapter/src/drivers/chafa.rs

	pub(super) async fn image_show(path: PathBuf, max: Rect) -> Result<Rect> {
		let child = Command::new("chafa")
			.args([
				"-f",

	fn create_demon(driver: Driver) -> Result<Child> {
		let result = Command::new("ueberzugpp")
			.args(["layer", "-so", driver.into_str()])
			.env("SPDLOG_LEVEL", if LOG_LEVEL.get().is_none() { "" } ...

		let new = lua.create_function(|_, (_, program): (Table, String)| {
			let mut inner = tokio::process::Command::new(program);
			inner.kill_on_drop(true).stdin(Stdio::null()).stdout(Stdio::null()).st...

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.yazi-runner/src/evaluator/job.rs

impl EvaluateJob {
	pub(super) fn eval(self) {
		let Self { runner, scope, name, bytes, arg } = self;
		let result = (|| -> mlua::Result<()> {

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.yazi-shared/src/condition.rs


	// Only used in `eval()`
	Term(String),
}

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.cspell.json+4

warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.scripts/moderate/main.js+3

warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.scripts/validate-form/main.js+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.scripts/validate-form/main.js+3

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

1244 files scanned @ 9129ffd | 8/25/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration0

file system access0

obfuscation13

supply chain0

owasp / injection0

telemetry

files 1244/1408rules hit 13engine v5commit 9129ffd

github

sxyazi/yazi

💥 Blazing fast terminal file manager written in Rust, based on async I/O.

Rust

41652

993

1157d

1408 files

1244 scanned(88%)

9129ffd

architecture░▒▓

entry (0) flagged (78) pkg (365)

765 nodes · 1591 edgesscroll to zoom · click node to jump to finding