live · scanning repos
Scanrepo
github.com
DANGER
malware detected
github.com / vdavid

vdavid/cmdr

Rust·9027 files·commit 343c926·scanned 4d ago·cached ✓
88/100
MALICIOUS
Matches known-malicious patterns. Do not clone or install.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?
Obfuscated code detected
33% file coverage
Partial architecture graph
Desktop app detected
threat-state: maliciouslive

FINDINGS ░▒▓

criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.apps/desktop/scripts/app-boot-guard.test.ts
  // eslint-disable-next-line @typescript-eslint/no-implied-eval
  const run = new Function('crypto', 'CSS', 'Object', 'Array', 'navigator', 'window', 'document', source) as (
    ...args: unknown[]
 ...
+5
warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.apps/desktop/src-tauri/src/accent_color.rs
    // We intentionally never remove it because we want updates for the entire session.
    unsafe {
        center.addObserverForName_object_queue_usingBlock(
            Some(NSSystemColorsDidChange...
+3
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.apps/desktop/src-tauri/src/accent_color_linux.rs
async fn read_accent_color_gsettings() -> Option<String> {
    let probe = tokio::process::Command::new("gsettings")
        .args(["get", "org.gnome.desktop.interface", "accent-color"])
        .outp...
+8
warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.apps/desktop/src-tauri/src/agent/memory/outcomes.rs
        // SAFETY: (test) `geteuid` takes no arguments, shares no memory, and can't fail.
        if unsafe { libc::geteuid() } == 0 {
            return;
        }
+3
warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.apps/desktop/src-tauri/src/ai/process.rs
    // process may already be gone — fire-and-forget).
    unsafe {
        libc::kill(pid as i32, libc::SIGKILL);
    }
+3
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.apps/desktop/src-tauri/src/ai/process.rs

    let child = std::process::Command::new(&binary_path)
        .env("DYLD_LIBRARY_PATH", &*ai_dir_str)
        .current_dir(ai_dir)
+8
criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.apps/desktop/src-tauri/src/cf_plist.rs
    fn drop(&mut self) {
        let _ = std::process::Command::new("/usr/bin/defaults")
            .args(["delete", &self.0])
            .output();
+8
infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2
warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.apps/desktop/src-tauri/src/ai/client.rs
/// Same per-adapter option fixups as [`chat_completion`] (see [`adjust_for_model`]). Reasoning,
/// thought-signature, and tool-call chunks are filtered out; callers only see the
/// visible text con...
+5
warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.apps/desktop/src-tauri/src/ai/client_real_gemini_test.rs
    let opts = opts();
    // Every Gemini response carries a `thoughtSignature` part beside the text one, so this
    // also proves `chat_completion_stream` keeps filtering those out of the visible ...
+5
warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.apps/desktop/src-tauri/src/commands/beta_signup.rs
//! Beta-tester signup Tauri command.
//!
//! Subscribes a beta contact email to the mailing list via the api-server's `POST /beta-signup`.
+5
warningClipboard read accessnavigator.clipboard.readText() reads the user's clipboard. In a wallet/crypto context this is often used to steal copied seed phrases or private keys.apps/desktop/src-tauri/src/clipboard/pasteboard.rs
/// Used by the frontend to paste text into input fields without triggering
/// WebKit's clipboard permission popup (which `navigator.clipboard.readText()` causes).
pub fn read_text_from_clipboard(_mt...
+4
warningClipboard read accessnavigator.clipboard.readText() reads the user's clipboard. In a wallet/crypto context this is often used to steal copied seed phrases or private keys.apps/desktop/src-tauri/src/commands/clipboard.rs
/// Used by the frontend to paste text into input fields. Going through Rust bypasses
/// WebKit's `navigator.clipboard.readText()` permission popup.
#[cfg(target_os = "macos")]
#[tauri::command]
+4
warningClipboard read accessnavigator.clipboard.readText() reads the user's clipboard. In a wallet/crypto context this is often used to steal copied seed phrases or private keys.apps/desktop/src/lib/clipboard-shim.test.ts
    expect(realWriteText).not.toHaveBeenCalled()
    await expect(navigator.clipboard.readText()).resolves.toBe('AAAA')
    expect(realReadText).not.toHaveBeenCalled()
  })
+4
criticalString-array obfuscation detectedCode resolves its string literals through a rotating string-array decoder — many `name(0xNNN)` index calls that reconstruct hidden strings at runtime. This is the structural signature of javascript-obfuscator regardless of the variable-naming scheme, so it fires even when mangled identifiers (e.g. `j5`, `jM`) are used to evade _0x-based detection. Commonly used to hide malware from code review.apps/desktop/src/lib/font-metrics/ranges.test.ts
  it('accepts ordinary code points', () => {
    expect(isMeasurable(0x41)).toBe(true)
    expect(isMeasurable(0x1f600)).toBe(true)
  })
+18
infoSuspicious file in repoVery large source file (523KB) — could contain obfuscated payloadapps/desktop/src/lib/intl/messages/en/errors.json+2
infoSuspicious file in repoVery large source file (731KB) — could contain obfuscated payloadapps/desktop/src/lib/intl/messages/screenshots/capture-report.json+2
infoSuspicious file in repoVery large source file (858KB) — could contain obfuscated payloadapps/desktop/src/lib/ipc/bindings.ts+2
warningDependency runs install scripts"<root>/preinstall" executes code during installation. Malicious packages use this to drop payloads before the app even runs.package.json+3

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

2998 files scanned @ 343c926 | 10/25/2026 | heuristic scan — always review manually

risk by category
code execution25
network & exfiltration25
file system access12
obfuscation15
supply chain9
owasp / injection0
telemetry
files 2998/9027rules hit 19engine v7commit 343c926

github

vdavid/cmdr

⌘ Crazy fast, keyboard-driven two-pane file manager for macOS. Source-available, free for personal use. With fully optional, privacy-first AI features.

Rust
117
9
308d
9027 files
2998 scanned(33%)
343c926

architecture░▒▓

entry (2) flagged (132) pkg (230)
630 nodes · 1150 edgesscroll to zoom · click node to jump to finding
⚠️ MALICIOUS (88/100) — vdavid/cmdr — ScanRepo