live · scanning repos
Scanrepo
github.com
github.com / youpi-pg

youpi-pg/YouPI-PG

JavaScript·363 files·commit e7a9dc0·scanned 7h ago·cached ✓
25/100
LOW RISK
Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 25 — 2,769 stars — findings likely legitimate code patterns

verdict accurate?
Research / educational context
threat-state: lowlive

FINDINGS ░▒▓

what this code does░▒▓

What happens when you open, install or run it, from the findings below.

  1. when runpackages/observer-sdk/src/browser-launcher.js and scripts/check-chrome.js reference browser profile paths, where saved logins and cookies live. packages/observer-sdk/src/browser-launcher.js, scripts/check-chrome.js
  2. when runscripts/build-android-apk.js references wallet or keystore paths. scripts/build-android-apk.js
infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2
infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.scripts/capture-all-assets.cjs
    const shotResult = await sendCommand('Page.captureScreenshot', { format: 'png' });
    const buffer = Buffer.from(shotResult.data, 'base64');

    const assetPath = path.join(assetsDir, filename);
+2
infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.scripts/take-screenshot.cjs
    const shotResult = await sendCommand('Page.captureScreenshot', { format: 'png' });
    const buffer = Buffer.from(shotResult.data, 'base64');
    fs.writeFileSync(outputPath, buffer);
    console....
+2
infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.scripts/test-single-user-and-pc-menu.cjs
    const shot1 = await sendCommand('Page.captureScreenshot', { format: 'png' });
    fs.writeFileSync('test_signin_single_saved_account.png', Buffer.from(shot1.data, 'base64'));
    console.log('Save...
+2
criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.packages/observer-sdk/src/browser-launcher.js
      'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe',
      process.env.LOCALAPPDATA ? path.join(process.env.LOCALAPPDATA, 'Google\\Chrome\\Application\\chrome.exe') : '',
      //...
+10
criticalCryptocurrency wallet directory accessAccessing wallet directories to steal private keys, seed phrases, or wallet data.scripts/build-android-apk.js
  console.log('🔏 [5/6] Signing APK with Android v2 + v3 cryptographic certificate...');
  const keystorePath = path.join(WORK_DIR, 'release.keystore');
  const ksPass = 'youpipg123';
  const alias = ...
+5
criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.scripts/check-chrome.js
  'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe',
  'C:\\Users\\gaura\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe'
];
+10
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.packages/core/src/qr-lib.js+4
infoMinified code in source directoryMinified/obfuscated code in source directories (not dist/) makes code review impossible.packages/core/src/qr-lib.js+3

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

182 files scanned @ e7a9dc0 | 10/30/2026 | heuristic scan — always review manually

risk by category
code execution2
network & exfiltration6
file system access20
obfuscation7
supply chain0
owasp / injection0
telemetry
files 182/363rules hit 9engine v10commit e7a9dc0

github

youpi-pg/YouPI-PG

A self-hosted UPI & COD payment gateway with zero per-transaction platform fees, universal JavaScript checkout integration, dynamic QR payments, WhatsApp OTP authentication, and automated payment verification.

JavaScript
2769
979
42d
363 files
182 scanned(50%)
e7a9dc0

network indicators░▒▓

Hosts this code names or would connect to. Top 50 of 52, decoded and call-site destinations first. Informational, not scored.

architecture░▒▓

entry (0) flagged (4) pkg (8)
165 nodes · 316 edgesscroll to zoom · click node to jump to finding