DANGER
malware detected
github.com / vdavid
vdavid/ cmdr
Rust·9027 files·commit 343c926·scanned 4d ago·cached ✓
88/100
MALICIOUS
Matches known-malicious patterns. Do not clone or install.
This repository contains patterns associated with malware. Do NOT run this code.
verdict accurate?
Obfuscated code detected
33% file coverage
Partial architecture graph
Desktop app detected
threat-state: maliciouslive
FINDINGS ░▒▓
criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.apps/desktop/scripts/app-boot-guard.test.ts
// eslint-disable-next-line @typescript-eslint/no-implied-eval const run = new Function('crypto', 'CSS', 'Object', 'Array', 'navigator', 'window', 'document', source) as ( ...args: unknown[] ...+5
warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.apps/desktop/src-tauri/src/accent_color.rs
// We intentionally never remove it because we want updates for the entire session.
unsafe {
center.addObserverForName_object_queue_usingBlock(
Some(NSSystemColorsDidChange...+3criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.apps/desktop/src-tauri/src/accent_color_linux.rs
async fn read_accent_color_gsettings() -> Option<String> {
let probe = tokio::process::Command::new("gsettings")
.args(["get", "org.gnome.desktop.interface", "accent-color"])
.outp...+8warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.apps/desktop/src-tauri/src/agent/memory/outcomes.rs
// SAFETY: (test) `geteuid` takes no arguments, shares no memory, and can't fail.
if unsafe { libc::geteuid() } == 0 {
return;
}+3warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.apps/desktop/src-tauri/src/ai/process.rs
// process may already be gone — fire-and-forget).
unsafe {
libc::kill(pid as i32, libc::SIGKILL);
}+3criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.apps/desktop/src-tauri/src/ai/process.rs
let child = std::process::Command::new(&binary_path)
.env("DYLD_LIBRARY_PATH", &*ai_dir_str)
.current_dir(ai_dir)+8criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.apps/desktop/src-tauri/src/cf_plist.rs
fn drop(&mut self) {
let _ = std::process::Command::new("/usr/bin/defaults")
.args(["delete", &self.0])
.output();+8warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.apps/desktop/src-tauri/src/ai/client.rs
/// Same per-adapter option fixups as [`chat_completion`] (see [`adjust_for_model`]). Reasoning, /// thought-signature, and tool-call chunks are filtered out; callers only see the /// visible text con...+5
warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.apps/desktop/src-tauri/src/ai/client_real_gemini_test.rs
let opts = opts();
// Every Gemini response carries a `thoughtSignature` part beside the text one, so this
// also proves `chat_completion_stream` keeps filtering those out of the visible ...+5warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.apps/desktop/src-tauri/src/commands/beta_signup.rs
//! Beta-tester signup Tauri command. //! //! Subscribes a beta contact email to the mailing list via the api-server's `POST /beta-signup`.+5
warningClipboard read accessnavigator.clipboard.readText() reads the user's clipboard. In a wallet/crypto context this is often used to steal copied seed phrases or private keys.apps/desktop/src-tauri/src/clipboard/pasteboard.rs
/// Used by the frontend to paste text into input fields without triggering /// WebKit's clipboard permission popup (which `navigator.clipboard.readText()` causes). pub fn read_text_from_clipboard(_mt...+4
warningClipboard read accessnavigator.clipboard.readText() reads the user's clipboard. In a wallet/crypto context this is often used to steal copied seed phrases or private keys.apps/desktop/src-tauri/src/commands/clipboard.rs
/// Used by the frontend to paste text into input fields. Going through Rust bypasses /// WebKit's `navigator.clipboard.readText()` permission popup. #[cfg(target_os = "macos")] #[tauri::command]+4
warningClipboard read accessnavigator.clipboard.readText() reads the user's clipboard. In a wallet/crypto context this is often used to steal copied seed phrases or private keys.apps/desktop/src/lib/clipboard-shim.test.ts
expect(realWriteText).not.toHaveBeenCalled()
await expect(navigator.clipboard.readText()).resolves.toBe('AAAA')
expect(realReadText).not.toHaveBeenCalled()
})+4criticalString-array obfuscation detectedCode resolves its string literals through a rotating string-array decoder — many `name(0xNNN)` index calls that reconstruct hidden strings at runtime. This is the structural signature of javascript-obfuscator regardless of the variable-naming scheme, so it fires even when mangled identifiers (e.g. `j5`, `jM`) are used to evade _0x-based detection. Commonly used to hide malware from code review.apps/desktop/src/lib/font-metrics/ranges.test.ts
it('accepts ordinary code points', () => {
expect(isMeasurable(0x41)).toBe(true)
expect(isMeasurable(0x1f600)).toBe(true)
})+18infoSuspicious file in repoVery large source file (523KB) — could contain obfuscated payloadapps/desktop/src/lib/intl/messages/en/errors.json+2
infoSuspicious file in repoVery large source file (731KB) — could contain obfuscated payloadapps/desktop/src/lib/intl/messages/screenshots/capture-report.json+2
infoSuspicious file in repoVery large source file (858KB) — could contain obfuscated payloadapps/desktop/src/lib/ipc/bindings.ts+2
warningDependency runs install scripts"<root>/preinstall" executes code during installation. Malicious packages use this to drop payloads before the app even runs.package.json+3
Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.
2998 files scanned @ 343c926 | 10/25/2026 | heuristic scan — always review manually
risk by category
code execution25
network & exfiltration25
file system access12
obfuscation15
supply chain9
owasp / injection0
telemetry
files 2998/9027rules hit 19engine v7commit 343c926
github
vdavid/cmdr
⌘ Crazy fast, keyboard-driven two-pane file manager for macOS. Source-available, free for personal use. With fully optional, privacy-first AI features.
117
9
308d
9027 files
2998 scanned(33%)
343c926
architecture░▒▓
entry (2) flagged (132) pkg (230)
630 nodes · 1150 edgesscroll to zoom · click node to jump to finding