togetherlabsgamespace/palooza-poker

308 files·commit 8cf94b0·scanned 9m ago·cached ✓

85/100

MALICIOUS

Matches known-malicious patterns. Do not clone or install.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?

Obfuscated code detected

Created 17 days ago

Crypto/Web3 project

Created 17 days ago

43% file coverage

threat-state: maliciouslive

FINDINGS ░▒▓

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.routes/api/auth.js


module.exports = router;                                                                                                                                                                               ...

criticalBrowser wallet app with Node/system accessThe repository interacts with browser wallets but also accesses the filesystem or executes shell/code. This context mismatch is typical of hybrid drainer/infostealer malware.+10

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

criticalRemote code fetch + executionFetching code from a remote server and executing it with eval() is the #1 pattern in LinkedIn/crypto scam malware.routes/api/auth.js+10

criticalWallet drainer pattern across filesThe repository touches browser wallet providers or signing APIs in one file and performs remote exfiltration/network calls in another. This is the canonical cross-file wallet drainer architecture.+12

infoBrowser wallet provider accessAccesses browser wallet providers (window.solana, window.ethereum, Phantom, Solflare, etc.). Common in Web3 apps but also the entry point for wallet drainers.client/src/utils/interact.js


  if (window.ethereum) {
    try {
      const currentChain = await window.ethereum.request({

criticaljavascript-obfuscator output detectedCode obfuscated with the javascript-obfuscator tool. The _0x variable naming and rotating string array are unique to this tool and are commonly used to hide malware from code review.routes/api/auth.js


module.exports = router;                                                                                                                                                                               ...

+20

criticalString-array obfuscation detectedCode resolves its string literals through a rotating string-array decoder — many `name(0xNNN)` index calls that reconstruct hidden strings at runtime. This is the structural signature of javascript-obfuscator regardless of the variable-naming scheme, so it fires even when mangled identifiers (e.g. `j5`, `jM`) are used to evade _0x-based detection. Commonly used to hide malware from code review.routes/api/auth.js


module.exports = router;                                                                                                                                                                               ...

+18

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.routes/api/auth.js+4

criticalObfuscated crypto project with remote network activityThe repository is obfuscated and makes remote network calls within a crypto/Web3 context. This combination is typical of concealed wallet drainers.+10

warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.client/src/apis/index.js+3

infoSuspicious file in repoVery large source file (970KB) — could contain obfuscated payloadclient/package-lock.json+2

infoAuthor has no other public repositoriesGitHub user "zug0x6179" has no other public repositories, common for burner accounts used in scams.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

131 files scanned @ 8cf94b0 | 9/25/2026 | heuristic scan — always review manually

risk by category

code execution20

network & exfiltration22

file system access2

obfuscation15

supply chain4

owasp / injection0

telemetry

files 131/308rules hit 13engine v6commit 8cf94b0

github

togetherlabsgamespace/palooza-poker

Palooza is a decentralized Metaverse platform where users can explore, create, and transact in a fully tokenized virtual world.

17d

308 files

131 scanned(43%)

8cf94b0

architecture░▒▓

entry (0) flagged (2) pkg (29)

155 nodes · 386 edgesscroll to zoom · click node to jump to finding