w3bs.AccountStart building
PACKAGES / Profullstack

threatcrush

Security agent daemon that monitors, scans and protects servers in real time.

ThreatCrush · No malware found
INSTALLw3bs install threatcrush.com/threatcrush

No w3bs yet? curl -fsSL https://w3bs.org/install.sh | sh

Get started

What to type once it is installed.

  1. w3bs install threatcrush.com/threatcrushInstall threatcrush and track it for updates
  2. threatcrush initAuto-detect services on this host and generate a config
  3. threatcrush monitorWatch nginx, auth and syslog for live attacks in the foreground
  4. threatcrush scan <path>Scan a codebase for vulnerabilities and leaked secrets
  5. threatcrush tuiOpen the interactive security dashboard

Every option: threatcrush --help · docs ↗

Malware scan

ThreatCrush found no malware indicators in threatcrush 0.13.66. The other findings below are ordinary code-review notes, not malware.

Scanned
2026-11-01 10:49 UTC · threatcrush 0.13.30
Files
1251 (installer + github.com/profullstack/threatcrush)
Findings
5 critical · 1 high · 20 medium · 181 low
100+ other findings (not malware)
  • critical
    AWS Access Keysource/modules/code-scanner/src/secrets/rules.ts:74secret-aws-access-key · CWE-798
  • critical
    AWS Access Keysource/packages/scan/src/secret-rules.ts:227secret-aws-access-key · CWE-798
  • critical
    AWS Access Keysource/packages/scan/src/secret-rules.ts:240secret-aws-access-key · CWE-798
  • critical
    Private Keysource/packages/scan/src/secret-rules.ts:307secret-private-key · CWE-798
  • critical
    AWS Access Keysource/prd/0003-detect-hardcoded-secrets-before-they-are-committed-or-served.md:126secret-aws-access-key · CWE-798
  • high
    Database URL with credentialssource/packages/scan/src/secret-rules.ts:259secret-database-url · CWE-798
  • medium
    SQL assembled by concatenation or interpolationsource/.github/workflows/migrate-dev2.yml:128sql-string-concatenation · CWE-89
  • medium
    regex with nested unbounded quantifierssource/apps/cli/src/core/crs/rules.generated.ts:4060redos-nested-quantifier · CWE-1333
  • medium
    buffer allocated without zeroingsource/apps/cli/src/core/log-tail.ts:58js-uninitialized-buffer · CWE-908
  • medium
    redirect to a non-constant destinationsource/apps/web/src/app/account/coinpay-card.tsx:44js-open-redirect · CWE-601
  • medium
    redirect to a non-constant destinationsource/apps/web/src/app/auth/login/page.tsx:76js-open-redirect · CWE-601
  • medium
    unescaped HTML renderingsource/apps/web/src/app/hire/page.tsx:110js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/src/app/hire/page.tsx:114js-unescaped-html-sink · CWE-79
  • medium
    redirect to a non-constant destinationsource/apps/web/src/app/invite/[token]/invite-client.tsx:55js-open-redirect · CWE-601
  • medium
    redirect to a non-constant destinationsource/apps/web/src/components/CheckoutPanel.tsx:99js-open-redirect · CWE-601
  • medium
    redirect to a non-constant destinationsource/apps/web/src/components/funding/FundingClient.tsx:97js-open-redirect · CWE-601
  • medium
    unescaped HTML renderingsource/apps/web/src/components/GuideReader.tsx:265js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/src/components/PitFooter.tsx:17js-unescaped-html-sink · CWE-79
  • medium
    regular expression compiled from a variablesource/apps/web/src/lib/credit-codes.ts:569js-regex-from-input · CWE-1333
  • medium
    redirect to a non-constant destinationsource/apps/web/src/lib/navigate.ts:3js-open-redirect · CWE-601
  • medium
    regex with nested unbounded quantifierssource/packages/scan/src/code-rules.ts:1113redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/scan/src/code-rules.ts:1149redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/scan/src/code-rules.ts:1169redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/scan/src/code-rules.ts:1211redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/scan/src/code-rules.ts:1224redos-nested-quantifier · CWE-1333
  • medium
    buffer allocated without zeroingsource/packages/scan/src/node-rules.ts:456js-uninitialized-buffer · CWE-908
  • low
    regex with nested unbounded quantifierssource/apps/cli/src/commands/__tests__/service.test.ts:98redos-nested-quantifier · CWE-1333
  • low
    Hardcoded Credentialsource/apps/cli/src/daemon/__tests__/authorized-key-added.test.ts:41secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/cli/src/daemon/workers/auto-update.ts:155secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/extension/__tests__/auth-token.test.js:17secret-generic-credential · CWE-798
  • low
    unescaped HTML renderingsource/apps/extension/__tests__/collect-page.test.js:9js-unescaped-html-sink · CWE-79
  • low
    unescaped HTML renderingsource/apps/extension/__tests__/collect-page.test.js:65js-unescaped-html-sink · CWE-79
  • low
    Hardcoded Credentialsource/apps/web/src/app/api/auth/login/__tests__/route.test.ts:70secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/web/src/app/api/auth/login/__tests__/route.test.ts:90secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/web/src/app/api/auth/login/__tests__/route.test.ts:99secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/web/src/app/api/auth/login/__tests__/route.test.ts:135secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/web/src/app/api/auth/refresh/route.ts:17secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/web/src/app/api/auth/reset-password/route.ts:26secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/web/src/app/api/auth/reset-password/route.ts:27secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/web/src/app/api/auth/signup/__tests__/route.test.ts:100secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/web/src/app/api/auth/signup/__tests__/route.test.ts:112secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/web/src/app/api/auth/signup/__tests__/route.test.ts:120secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/web/src/app/api/auth/signup/__tests__/route.test.ts:131secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/web/src/app/api/auth/signup/__tests__/route.test.ts:156secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/web/src/app/api/auth/signup/__tests__/route.test.ts:172secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/web/src/app/api/auth/signup/__tests__/route.test.ts:183secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/web/src/app/api/auth/signup/__tests__/route.test.ts:199secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/web/src/app/api/auth/signup/__tests__/route.test.ts:208secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/web/src/app/api/auth/signup/__tests__/route.test.ts:230secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/web/src/app/api/auth/signup/__tests__/route.test.ts:246secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/web/src/app/api/auth/signup/__tests__/route.test.ts:273secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/web/src/app/api/auth/signup/__tests__/route.test.ts:284secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/web/src/app/api/github/monitoring/__tests__/route.test.ts:43secret-generic-credential · CWE-798
  • low
    MAC or signature compared with ==source/apps/web/src/app/api/webhooks/github/__tests__/marketplace-route.test.ts:81js-timing-unsafe-mac-compare · CWE-208
  • low
    Hardcoded Credentialsource/apps/web/src/lib/__tests__/github-marketplace.test.ts:13secret-generic-credential · CWE-798
  • low
    dynamic code executionsource/apps/web/src/lib/__tests__/github-repo-scan.test.ts:145js-dynamic-code-execution · CWE-95
  • low
    SQL assembled by concatenation or interpolationsource/apps/web/src/lib/__tests__/open-threats.test.ts:29sql-string-concatenation · CWE-89
  • low
    dynamic code executionsource/modules/code-scanner/src/__tests__/sast.test.ts:30js-dynamic-code-execution · CWE-95
  • low
    shell execution with an interpolated stringsource/modules/code-scanner/src/__tests__/sast.test.ts:31js-shell-exec-interpolation · CWE-78
  • low
    dynamic code executionsource/modules/code-scanner/src/__tests__/sast.test.ts:45js-dynamic-code-execution · CWE-95
  • low
    dynamic code executionsource/modules/code-scanner/src/__tests__/sast.test.ts:46js-dynamic-code-execution · CWE-95
  • low
    SQL built from a template literal or f-stringsource/modules/code-scanner/src/__tests__/sast.test.ts:62sql-template-interpolation · CWE-89
  • low
    TLS certificate verification disabledsource/modules/code-scanner/src/__tests__/sast.test.ts:67tls-verification-disabled · CWE-295
  • low
    predictable randomness used for a security valuesource/modules/code-scanner/src/__tests__/sast.test.ts:73insecure-randomness-for-secret · CWE-338
  • low
    unescaped HTML renderingsource/modules/code-scanner/src/__tests__/sast.test.ts:82js-unescaped-html-sink · CWE-79
  • low
    write to a prototype-reachable keysource/modules/code-scanner/src/__tests__/sast.test.ts:87js-prototype-pollution · CWE-1321
  • low
    shell execution with an interpolated stringsource/modules/code-scanner/src/__tests__/sast.test.ts:102js-shell-exec-interpolation · CWE-78
  • low
    shell execution with an interpolated stringsource/modules/code-scanner/src/__tests__/sast.test.ts:108js-shell-exec-interpolation · CWE-78
  • low
    file path built from a variablesource/modules/code-scanner/src/__tests__/sast.test.ts:118js-path-traversal · CWE-22
  • low
    dynamic code executionsource/modules/code-scanner/src/__tests__/sast.test.ts:137js-dynamic-code-execution · CWE-95
  • low
    dynamic code executionsource/modules/code-scanner/src/__tests__/sast.test.ts:146js-dynamic-code-execution · CWE-95
  • low
    dynamic code executionsource/modules/code-scanner/src/__tests__/sast.test.ts:159js-dynamic-code-execution · CWE-95
  • low
    dynamic code executionsource/modules/code-scanner/src/__tests__/sast.test.ts:165js-dynamic-code-execution · CWE-95
  • low
    Private Keysource/modules/code-scanner/src/__tests__/secrets.test.ts:36secret-private-key · CWE-798
  • low
    Database URL with credentialssource/modules/code-scanner/src/__tests__/secrets.test.ts:124secret-database-url · CWE-798
  • low
    GitHub Tokensource/modules/code-scanner/src/__tests__/secrets.test.ts:138secret-github-token · CWE-798
  • low
    AWS Access Keysource/modules/code-scanner/src/__tests__/secrets.test.ts:145secret-aws-access-key · CWE-798
  • low
    AWS Access Keysource/modules/code-scanner/src/__tests__/secrets.test.ts:155secret-aws-access-key · CWE-798
  • low
    Hardcoded Credentialsource/modules/code-scanner/src/__tests__/secrets.test.ts:184secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/modules/code-scanner/src/__tests__/secrets.test.ts:189secret-generic-credential · CWE-798
  • low
    Database URL with credentialssource/modules/code-scanner/src/__tests__/secrets.test.ts:244secret-database-url · CWE-798
  • low
    SQL assembled by concatenation or interpolationsource/packages/scan/src/__tests__/code-rules.test.ts:21sql-string-concatenation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/packages/scan/src/__tests__/code-rules.test.ts:31sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/packages/scan/src/__tests__/code-rules.test.ts:35sql-template-interpolation · CWE-89
  • low
    SQL assembled by concatenation or interpolationsource/packages/scan/src/__tests__/code-rules.test.ts:40sql-string-concatenation · CWE-89
  • low
    SQL assembled by concatenation or interpolationsource/packages/scan/src/__tests__/code-rules.test.ts:49sql-string-concatenation · CWE-89
  • low
    SQL assembled by concatenation or interpolationsource/packages/scan/src/__tests__/code-rules.test.ts:53sql-string-concatenation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/packages/scan/src/__tests__/code-rules.test.ts:76sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/packages/scan/src/__tests__/code-rules.test.ts:79sql-template-interpolation · CWE-89
  • low
    shell execution with an interpolated stringsource/packages/scan/src/__tests__/code-rules.test.ts:87js-shell-exec-interpolation · CWE-78
  • low
    regex with nested unbounded quantifierssource/packages/scan/src/__tests__/code-rules.test.ts:164redos-nested-quantifier · CWE-1333
  • low
    YAML parsed with type resolution enabledsource/packages/scan/src/__tests__/code-rules.test.ts:257js-unsafe-yaml-load · CWE-502
  • low
    YAML parsed with type resolution enabledsource/packages/scan/src/__tests__/code-rules.test.ts:261js-unsafe-yaml-load · CWE-502
  • low
    unescaped HTML renderingsource/packages/scan/src/__tests__/code-rules.test.ts:604js-unescaped-html-sink · CWE-79
  • low
    predictable randomness used for a security valuesource/packages/scan/src/__tests__/code-rules.test.ts:803insecure-randomness-for-secret · CWE-338
  • low
    wildcard CORS origin with credentialssource/packages/scan/src/__tests__/code-rules.test.ts:837js-cors-wildcard-credentials · CWE-942
  • low
    cookie set with Secure disabledsource/packages/scan/src/__tests__/code-rules.test.ts:846js-cookie-insecure-flag · CWE-614
  • low
    hardcoded key materialsource/packages/scan/src/__tests__/code-rules.test.ts:853js-hardcoded-crypto-key · CWE-321
  • low
    NoSQL query built from request datasource/packages/scan/src/__tests__/code-rules.test.ts:927js-nosql-injection · CWE-943
  • low
    static initialization vectorsource/packages/scan/src/__tests__/code-rules.test.ts:967js-predictable-cipher-iv · CWE-329

Showing the first 100 findings.

Badge for your README

ThreatCrush: No malware found

[![ThreatCrush scan](https://w3bs.org/api/packages/threatcrush.com/threatcrush/badge.svg)](https://w3bs.org/packages/threatcrush.com/threatcrush)