the repository provides a service to detect rug pulls in ai trading agents, using various analysis methods. the findings indicate potential security risks in the implementation, but the intent appears to be defensive and research-oriented.
This repository contains patterns associated with malware. Do NOT run this code.
verdict accurate?
Crypto/Web3 project
threat-state: maliciouslive
FINDINGS ░▒▓
warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.scripts/retrain.py
print(f" urllib failed ({type(e).__name__}), falling back to curl")
out = subprocess.run(["curl", "-sSf", "--max-time", "180", LIVE],
capture_output=True,...
+4
criticalSuspicious code is reachable from an entry pointFlagged files are imported by the application's entry path: src/accuracy.ts, src/alpha.ts, src/bazaar.ts. This means the suspicious code can execute when the app runs.+8
warningCluster of suspicious files reachable from entry25 flagged files form a connected cluster that is reachable from an entry point, suggesting coordinated malicious behavior rather than isolated false positives.+5
infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2
infoLLM: classified as security tool / researchAI analysis classified this repo as a security tool, POC, or research project with medium confidence. It may implement dangerous capabilities, but the stated intent appears legitimate. the repository provides a service to detect rug pulls in ai trading agents, using various analysis methods. the findings indicate potential security risks in the implementation, but the intent appears to be defensive and research-oriented.+0
warningHigh-entropy string literalsFound 15 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.src/index.ts+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.src/index.ts+3
warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.scripts/gen_survival.py+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.scripts/gen_survival.py+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.scripts/parity-check.mts+3
warningHigh-entropy string literalsFound 8 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.scripts/port-bundle.mts+3
infoAuthor has no other public repositoriesGitHub user "actions-user" has no other public repositories, common for burner accounts used in scams.+2
Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.
AI analysis classified this repo as a security tool, POC, or research project with medium confidence. It may implement dangerous capabilities, but the stated intent appears legitimate. the repository provides a service to detect rug pulls in ai trading agents, using various analysis methods. the findings indicate potential security risks in the implementation, but the intent appears to be defensive and research-oriented.
confidence medium · informs the score, does not decide it
telemetry
files 89/107rules hit 12engine v5commit e69d0d0
github
wyattpalm2-eng/x402-seller
Rug protection for AI trading agents — composite honeypot score + liquidity-drain detector, paid per-call in USDC via x402 (no signup, no API key). Free demo + public self-graded track record. MCP server included.
TypeScript
2
0
38d
107 files
89 scanned(83%)
e69d0d0
architecture░▒▓
entry (1) flagged (32) pkg (25)
101 nodes · 227 edgesscroll to zoom · click node to jump to finding