# Is openyard-cloud/vetcode-demo-malware safe? Code check by OpenYard

Repository: https://github.com/openyard-cloud/vetcode-demo-malware
Page: https://openyard.cloud/check/openyard-cloud/vetcode-demo-malware

Verdict: Signs of malicious code.
Checked 2026-11-10 at commit ca9f6d0 by vetcode 0.3.1, reading 4 files without running anything.

What the code can do:
- Reads secrets or environment variables (1 file)
- Connects to the internet (1 file) (new since the previous check)
- Starts other programs (1 file)
- Reads user and machine details (1 file)
- Builds or decodes code while running (1 file)

Malware and supply-chain findings:
- critical: Runs code that is decoded at runtime (mal-eval-decoded) at https://github.com/openyard-cloud/vetcode-demo-malware/blob/ca9f6d009390f561b85a114032ffacbf2e2e925f/scripts/setup.js#L7
- critical: Runs code that is decoded at runtime (mal-eval-decoded) at https://github.com/openyard-cloud/vetcode-demo-malware/blob/ca9f6d009390f561b85a114032ffacbf2e2e925f/scripts/setup.js#L16
- critical: Install-time code combines network access with secrets, programs or hidden code (install-time-capabilities) at https://github.com/openyard-cloud/vetcode-demo-malware/blob/ca9f6d009390f561b85a114032ffacbf2e2e925f/scripts/setup.js#L1
- high: eval next to base64 decoding (mal-eval-base64) at https://github.com/openyard-cloud/vetcode-demo-malware/blob/ca9f6d009390f561b85a114032ffacbf2e2e925f/scripts/setup.js#L16

These are patterns, not proof. Vulnerability candidates and leaked-secret locations are not published.

To review it more deeply, install the vetcode skill in an AI coding agent (npx skills add openyard-cloud/vetcode) and ask it to review https://github.com/openyard-cloud/vetcode-demo-malware.