Scan report

bilawalsidhu / gods-eye-view

View on GitHub (opens in a new tab)
JavaScript
54046 stars
Scanned 13 Oct 2026, 05:48

Report Rescan

Vulnerability Safe

Could an attacker exploit mistakes in this code?

0 risk score

No issues of this kind were found.

High: 0
Medium: 0
Low: 0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern High

Does this code look like it is trying to cause harm?

63 risk score

Serious issues. Review the high-severity findings before using it.

High: 16
Medium: 4
Low: 25

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

45 total findings

Likely real: 17
Uncertain: 0
Likely noise: 28

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

This repository shows two very different kinds of problems that need to be addressed separately. The most serious issue is that the code contains signs of intentional malicious behavior, such as decoding hidden data and executing it, which suggests the developer may have been trying to hide something or bypass security checks rather than just making a mistake. While the overall vulnerability risk is rated as safe because there are no obvious bugs that could be exploited right now, the high score for malicious patterns indicates that the codebase might be hiding dangerous activities. You should treat this as a potentially risky environment where you need to verify if the suspicious scripts are actually being used and whether the loose version constraints in the dependencies pose any real threat before trusting the system.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

GuardDog 17

Supply-chain attack heuristics · Malicious pattern
Dependency checker 16

CVEs, typosquats and risky installs · Supply chain
YARA 12

Malware signature rules · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/scripts/qa-overlay-baseline.mjs line 888

Likely real
Yes, 98% confidence

Detects system info collection combined with network exfiltration (hostname/user in HTTP requests) [threat-network-exfil-sysinfo]
```
machine: {
        hostname: os.hostname(),
        platform: os.platform(),
        release: os.release(),
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/scripts/qa-focus-evidence.mjs line 621

Likely real
Yes, 98% confidence

Detects system info collection combined with network exfiltration (hostname/user in HTTP requests) [threat-network-exfil-sysinfo]
```
machine: {
      hostname: os.hostname(),
      platform: os.platform(),
      arch: os.arch(),
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/scripts/qa-focus-evidence.mjs line 633

Likely real
Yes, 98% confidence

Detects system info collection combined with network exfiltration (hostname/user in HTTP requests) [threat-network-exfil-sysinfo]
```
const requestedParams = parseParams();
  const response = await fetch(APP_URL).catch((error) => ({ ok: false, statusText: error.message }));
  if (!response.ok) {
    throw new Error(`Live dev...
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/scripts/qa-camera-controls.mjs line 115

Likely real
Yes, 91% confidence

Detects steganography decode followed by code execution [threat-runtime-obfuscation-steganography]
```
);
  await page.$eval('[data-collapse-target="cctv-panel"]', (button) =>
    button.click(),
  );
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/scripts/qa-cctv-v2.mjs line 566

Likely real
Yes, 98% confidence

Detects unicode homoglyphs and uncommon characters used for obfuscation [threat-runtime-obfuscation-unicode]
```
geomBeforeReselect === geomAfterReselect,
      `probeΔ=${cAfterReselect.pickFromRay - cAfterActivate.pickFromRay}, geometryChanged=${geomBeforeReselect !== geomAfterReselect}`,
    );
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/scripts/setup-doctor.mjs line 95

Likely real
Yes, 96% confidence

Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]
```
const values = {};
  for (const filename of ['.env', '.env.local', `.env.${mode}`, `.env.${mode}.local`]) {
    const filepath = path.join(rootDir, filename);
    if (!existsSync(filepath)) continue;
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/server/standalone/key-setup.js line 100

Likely real
Yes, 96% confidence

Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]
```
sourceRoot,
      ...(pinokioManaged() ? ['pinokio', 'ENVIRONMENT'] : ['.env']),
    );
  // Read the store, distinguishing "no store yet" from "cannot read this
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/build/vite.js line 96

Likely real
Yes, 96% confidence

Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]
```
fs: {
        deny: ['.env', '.env.*', '*.{crt,pem}', '**/.git/**', '**/ENVIRONMENT'],
      },
      // These headers protect the document containing Provider Settings and
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/scripts/qa-focus-evidence.mjs line 623

Likely real
Yes, 93% confidence

Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info]
```
platform: os.platform(),
      arch: os.arch(),
    },
    caveat: HEADFUL
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/scripts/qa-focus-evidence.mjs line 622

Likely real
Yes, 93% confidence

Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info]
```
hostname: os.hostname(),
      platform: os.platform(),
      arch: os.arch(),
    },
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/scripts/qa-focus-evidence.mjs line 621

Likely real
Yes, 93% confidence

Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info]
```
machine: {
      hostname: os.hostname(),
      platform: os.platform(),
      arch: os.arch(),
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/server/providers/firms.js line 51

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
const mapKey = () => String(process.env.FIRMS_MAP_KEY || '').trim();

  async function readDiskOnce() {
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/server/providers/traffic.js line 183

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
if (urlPath === '/status') {
          const hasKey = Boolean(process.env.TOMTOM_API_KEY);
          const b = currentBudget();
          sendJson(200, {
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/server/providers/traffic.js line 144

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
...'https://api.tomtom.com/traffic/map/4/tile/flow/relative/' +
      `${z}/${x}/${y}.pbf?key=${encodeURIComponent(process.env.TOMTOM_API_KEY)}`;
    recordUpstreamFetch(); // attempts count — upstream bills the request either way
    const res = await ...
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/scripts/qa-l9-matrix.mjs line 296

Likely real
Yes, 83% confidence

Detects fully silent process execution (suppressing all output channels) [threat-process-spawn-silent]
```
// a websocket alive and contaminates every later check in the fleet.
      detached: true,
    });
    let out = '';
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/server/providers/openai/codex-auth.js line 198

Likely real
Yes, 83% confidence

Detects fully silent process execution (suppressing all output channels) [threat-process-spawn-silent]
```
cwd: home,
        detached: true,
        stdio: 'ignore',
        env: codexLoginEnvironment(environment, loginHome),
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/scripts/qa-l9-matrix.mjs line 292

Likely real
Yes, 83% confidence

Detects fully silent process execution (suppressing all output channels) [threat-process-spawn-silent]
```
env: { ...process.env, ...extraEnv },
      stdio: ['ignore', 'pipe', 'pipe'],
      // Own process group: killing a timed-out harness must also take its
      // Chromium descendants down. An orphaned browser keeps a GPU context and
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'mapillary-js^4.1.2' — attacker could push malicious update
```
mapillary-js:^4.1.2
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@jtarrio/webrtlsdr^3.0.6' — attacker could push malicious update
```
@jtarrio/webrtlsdr:^3.0.6
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'hls.js^1.7.3' — attacker could push malicious update
```
hls.js:^1.7.3
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'egm96-universal^1.1.1' — attacker could push malicious update
```
egm96-universal:^1.1.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'cesium^1.124.0' — attacker could push malicious update
```
cesium:^1.124.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@meri-imperiumi/eccodes-wasm^2.48.2' — attacker could push malicious update
```
@meri-imperiumi/eccodes-wasm:^2.48.2
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@mapbox/vector-tile^3.0.0' — attacker could push malicious update
```
@mapbox/vector-tile:^3.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'ws^8.21.0' — attacker could push malicious update
```
ws:^8.21.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'mgrs^2.1.0' — attacker could push malicious update
```
mgrs:^2.1.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'pbf^5.1.2' — attacker could push malicious update
```
pbf:^5.1.2
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'satellite.js^6.0.2' — attacker could push malicious update
```
satellite.js:^6.0.2
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'puppeteer^25.10.0' — attacker could push malicious update
```
puppeteer:^25.10.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'sharp^0.35.4' — attacker could push malicious update
```
sharp:^0.35.4
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'vite^6.0.0' — attacker could push malicious update
```
vite:^6.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@jtarrio/signals^0.10.0' — attacker could push malicious update
```
@jtarrio/signals:^0.10.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'vite-plugin-cesium^1.2.23' — attacker could push malicious update
```
vite-plugin-cesium:^1.2.23
```