github.com / tw93

tw93/Mole

Shell·262 files·commit 239c90d·scanned 3m ago·cached ✓

15/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 15 — 68,394+ stars — findings likely false positives

verdict accurate?

68,394 stars

CLI tool detected

threat-state: lowlive

FINDINGS ░▒▓

criticalGo os/exec usageos/exec is used to run external commands. In malware it drops payloads, modifies the system, or opens shells.cmd/analyze/delete.go


	cmd := exec.CommandContext(ctx, trashBinary, absPath)
	output, err := cmd.CombinedOutput()
	if err != nil {

criticalGo os/exec usageos/exec is used to run external commands. In malware it drops payloads, modifies the system, or opens shells.cmd/analyze/insights.go


	cmd := exec.CommandContext(ctx, "du", "-sk", path)
	output, err := cmd.Output()
	if err != nil {

criticalGo os/exec usageos/exec is used to run external commands. In malware it drops payloads, modifies the system, or opens shells.cmd/analyze/main.go

	}
	return exec.CommandContext(ctx, "open", args...).Run()
}

criticalRemote script piped into a shellA shell script downloads remote content and executes it directly (e.g. `curl … | bash`). The payload is never stored or reviewable and can change server-side — a classic malware/backdoor install pattern.install.sh

    local curl_exit=0
    # Capture curl's stderr per attempt and surface it only when the download
    # ultimately fails: a transient TLS reset that the retry recovers from is
    # not news, and pr...

+10

warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.tests/purge_menu_pty.py

    fcntl.ioctl(0, termios.TIOCSCTTY, 0)
p = subprocess.Popen(['/bin/bash', '--noprofile', '--norc', '-c', script],
                     stdin=slave, stdout=slave, stderr=slave, env=env, preexec_fn=ow...

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.lib/clean/user.sh

    if mole_cleanup_targets_exist \
        "$HOME/Library/Application Support/Google/Chrome"/*/Application\ Cache/* \
        "$HOME/Library/Application Support/Google/Chrome"/*/Code\ Cache/* \
     ...

+10

criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.lib/manage/whitelist.sh

Codex Desktop update staging|$HOME/Library/Caches/com.openai.codex/org.sparkle-project.Sparkle/Installation|ai_ml_cache
Chrome on-device AI models|$HOME/Library/Application Support/Google/Chrome/OptGu...

+10

infoAuthor has no other public repositoriesGitHub user "github-actions[bot]" has no other public repositories, common for burner accounts used in scams.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

134 files scanned @ 239c90d | 9/25/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration0

file system access20

obfuscation0

supply chain2

owasp / injection0

telemetry

files 134/262rules hit 9engine v6commit 239c90d

github

tw93/Mole

🐹 Clean, uninstall, analyze, optimize, and monitor your Mac. Free open-source CLI, plus a native Mac app.

Shell

68394

2405

367d

262 files

134 scanned(51%)

239c90d

architecture░▒▓

entry (0) flagged (9) pkg (45)

111 nodes · 198 edgesscroll to zoom · click node to jump to finding