github.com / tobi

tobi/disktree

Rust·71 files·commit 9b18b27·scanned 2d ago·cached ✓

25/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 25 — 3,723 stars — findings likely legitimate code patterns

verdict accurate?

threat-state: lowlive

FINDINGS ░▒▓

criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.crates/disktree-app/src/git.rs

        }
        Command::new("xcode-select")
            .arg("-p")
            .stdin(Stdio::null())

warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.crates/disktree-app/src/main.rs

        // there was no console to attach to.
        unsafe {
            AttachConsole(ATTACH_PARENT_PROCESS);
        }

    {
        Command::new(std::env::current_exe().context("find disktree")?)
            .args(std::env::args_os().skip(1))
            .env("DISKTREE_CMUX_DETACHED", "1")

        assert!(
            Command::new("sh")
                .arg("-n")
                .arg(&script_path)

            // that many bytes and not otherwise borrowed during the call.
            let count = unsafe {
                getattrlistbulk(
                    self.fd.as_raw_fd(),

        // and the class is the one the records are read as.
        let filled = unsafe {
            GetFileInformationByHandleEx(
                self.handle.as_raw_handle(),

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

48 files scanned @ 9b18b27 | 10/27/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration0

file system access0

obfuscation0

supply chain0

owasp / injection0

telemetry

files 48/71rules hit 7engine v7commit 9b18b27

github

tobi/disktree

A treemap for finding and removing what fills your disk, for Omarchy. Rust + GPUI.

Rust

3723

223

35d

71 files

48 scanned(68%)

9b18b27

architecture░▒▓

entry (0) flagged (14) pkg (56)

102 nodes · 95 edgesscroll to zoom · click node to jump to finding