Scan report

tentone / potree-core

View on GitHub (opens in a new tab)
JavaScript
255 stars
Scanned 24 Sep 2026, 10:29

Report Rescan

Vulnerability Safe

Could an attacker exploit mistakes in this code?

0 risk score

No issues of this kind were found.

High: 0
Medium: 0
Low: 1

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Low

Does this code look like it is trying to cause harm?

1 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 1
Medium: 0
Low: 3

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

5 total findings

Likely real: 1
Uncertain: 1
Likely noise: 3

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

1 finding likely need attention, 3 look like noise. Most notable: YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character... in /source/loading2/libs/brotli/decode.min.js (1% confidence).

Detections by engine

Dependency checker 2

CVEs, typosquats and risky installs · Supply chain
Semgrep 1

Pattern-based code analysis · Vulnerability
YARA 1

Malware signature rules · Malicious pattern
GuardDog 1

Supply-chain attack heuristics · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/source/loading2/libs/brotli/decode.js line 2294

Likely real
Yes, 95% confidence

Detects heavy obfuscation techniques commonly used by malware [threat-runtime-obfuscation]
```
...'timedownlifeleftbackcodedatashowonlysitecityopenjustlikefreeworktextyearoverbodyloveformbookplaylivelinehelphomesidemorewordlongthemviewfindpagedaysfullheadtermeachareafromtruemarkableuponhighdatelandnewsevennextcasebothpostusedmadehandherewhatnameLinkblogsizebaseheldmakemainuser...
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/source/loading2/brotli-decoder.worker.js line 75

Likely real
Uncertain, 33% confidence

Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.
```
console.error(`problem with node ${name}: `, e);
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@types/three^0.152.1' — attacker could push malicious update
```
@types/three:^0.152.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'three^0.154.0' — attacker could push malicious update
```
three:^0.154.0
```