github.com / tt-a1i

tt-a1i/archify

JavaScript·1174 files·commit 25cf370·scanned 5d ago·cached ✓

15/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 15 — 87,548+ stars — findings likely false positives

verdict accurate?

87,548 stars

Crypto/Web3 project

Partial architecture graph

CLI tool detected

threat-state: lowlive

FINDINGS ░▒▓

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.test/reading-address-browser.test.mjs

      for (const [setup, action, state] of ${JSON.stringify(states)}) {
        const selected = eval(setup), copied = await eval(action);
        results.push({ selected, copied, text, state, clipboa...

criticalSuspicious code is reachable from an entry pointFlagged files are imported by the application's entry path: website/src/data/gallery-presentation.mjs. This means the suspicious code can execute when the app runs.+8

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.archify/explainer/browser-check.mjs

      if(!result.data)throw new Error('Chrome returned an empty screenshot.');
      const bytes=Buffer.from(result.data,'base64');if(writeScreenshot)writeScreenshot(bytes);else fs.writeFileSync(scree...

infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.test/reader-layout-browser.test.mjs

            const capture = await send('Page.captureScreenshot', { format: 'png' });
            fs.writeFileSync(path.join(evidence, `architecture-1440x900-${theme}.png`), Buffer.from(capture.data, '...

infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.website/test/agent-diagrams-browser.test.mjs

            const image = await browser.cdp.send('Page.captureScreenshot', { format: 'png' }, session);
            fs.writeFileSync(path.join(output, name), Buffer.from(image.data, 'base64'));
      ...

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.website/src/data/site-translations.mjs+4

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.archify/delta/architecture-delta.mjs+4

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.archify/explainer/browser-check.mjs+4

warningHigh-entropy string literalsFound 5 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.website/src/data/gallery-presentation.mjs+3

warningHigh-entropy string literalsFound 16 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.website/src/data/site-translations.mjs+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.archify/delta/architecture-delta.mjs+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.archify/explainer/browser-check.mjs+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.archify/explainer/parse.mjs+3

warningHigh-entropy string literalsFound 8 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.archify/recipes/scenarios.mjs+3

infoSuspicious file in repoVery large source file (996KB) — could contain obfuscated payloadarchify/renderers/shared/generated-validators.mjs+2

infoSuspicious file in repoExecutable file (windows-path-fixtures.ps1) in repositoryscripts/windows-path-fixtures.ps1+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

640 files scanned @ 25cf370 | 10/22/2026 | heuristic scan — always review manually

risk by category

code execution18

network & exfiltration6

file system access0

obfuscation15

supply chain4

owasp / injection0

telemetry

files 640/1174rules hit 17engine v7commit 25cf370

github

tt-a1i/archify

Turn any idea, plan, or codebase into a beautiful interactive diagram. An agent skill for Claude Code, Codex, and more.

JavaScript

87548

5898

197d

1174 files

640 scanned(55%)

25cf370

architecture░▒▓

entry (1) flagged (9) pkg (18)

418 nodes · 541 edgesscroll to zoom · click node to jump to finding