Report example
Read a scan.Before you run anything.
Open the offline HTML report to see how Repyy presents findings, source locations, and coverage. It was generated from 11 inert risky fixtures and 11 paired controls with a local build of the 0.6.0 code (0.6.0-dev). The fixtures are data; the runner invoked only Repyy. The build is a prerelease preview, not an attested release binary.
Open the HTML view, then compare the terminal view or JSON. The case results include every observed rule and control finding.
Three things to read first
| Report field | What it tells you | Next step |
|---|---|---|
| Verdict | Whether the findings require review or the scan is incomplete. | Use it to triage, then inspect the underlying evidence. |
| Rule and location | What matched and where Repyy found it. | Read the source at that line; open the rule reference for legitimate-use guidance. |
| Coverage | Files scanned, skipped files, and limits reached. | Treat an incomplete scan as unresolved, even if it has no relevant findings. |
Try three paired examples
These fixtures show what a signal looks like beside a nearby benign use. None of the fixture code or dependencies is executed or installed.
| Risky fixture | Expected signal | Paired control |
|---|---|---|
A JSON manifest declares process-log. | Sourced package indicator | An ordinary fixture package declaration. |
An unused function passes Axios response data to eval. | Fetch-to-execution flow | An Axios response returned as data. |
| Numeric literals encode a credential-path marker. | Decoded literal evidence | Numeric literals spelling “Hello”. |
Eight earlier fixture pairs still cover lifecycle scripts, startup configuration, disguised assets, editor tasks, Git hooks, download strings, credential-path references, and Docker socket mounts.
Reproduce the inert report
From a Repyy source checkout, build only Repyy and run its fixture runner. The runner creates temporary text files and removes them after scanning.
go build -trimpath -ldflags '-X main.version=0.6.0-dev' -o /tmp/repyy-demo ./cmd/repyy
python3 scripts/benchmark.py --binary /tmp/repyy-demo --output /tmp/repyy-demo-output --check
Outputs include sample.html, sample.txt, sample.json, results.json, and results.md. The runner does not invoke npm, Node, Git in a fixture, Docker, an IDE task, or any fixture program.
What the real corpus adds
A separate static review of the pinned malicious-repositories corpusexamined 15 targets with Repyy 0.5.3-dev. Thirteen scans completed; two were incomplete with four skipped files. The review exposed a missing process-log indicator, an Axios-response-to-eval path that was not correlated, and noisy vendor bundles. Those observations motivated the focused fixtures above. A separately reviewed, isolated run is still needed before publishing 0.6.0 corpus measurements.
OpenSSF Malicious Packages is a source of package advisory reports, separate from the repository corpus. Neither source proves remote payload contents or a common actor.
Keep the limits in view
Eleven paired fixtures are a regression check, not a general accuracy score. A clean control means only that it received no high or critical finding in this run; lower-severity findings remain in the results. Repyy can miss behavior, flag legitimate code, or leave files uninspected.Read the coverage guide before using a scan to decide whether to trust a repository.