This repository is an antivirus evasion toolkit designed to help bypass security detection through various techniques. It provides tools to encrypt shellcode using XOR and Base64 encoding, along with loaders that decrypt and execute the payload in memory while implementing anti-analysis checks. The toolkit has evolved over time with versions in C, Nim, and C++, showing progressively more sophisticated evasion techniques including API hooking, memory patching, string obfuscation, and cryptographic payload protection. The code demonstrates understanding of Windows internals and offensive security techniques.
This repository implements a comprehensive Telegram bot for managing VPN subscriptions via Remnawave panel integration, featuring a web-based admin cabinet (cabinet) and public API (webapi). The system handles user subscriptions, payments (20+ gateways), referrals, promotional systems, contests, news, and support tickets. Architected with modular layers: Telegram bot handlers (aiogram), cabinet/web API routes (FastAPI), service-layer business logic, and SQLAlchemy ORM with Alembic migrations. Key entry points include main.py (application bootstrap), bot.py (Telegram setup), and unified_app.py (combined web server). Data flows involve Telegram interactions → handler processing → service execution → database CRUD operations, with webhook handlers for payment gateway callbacks and panel synchronization. External dependencies include Telegram Bot API, Remnawave API, PostgreSQL, Redis, SMTP, and numerous payment processors (Yookassa, CryptoBot, etc.). The codebase demonstrates strong engineering practices: clean separation of concerns, dependency injection, structured logging (structlog), and reusable patterns like event emitters, caching utilities, and retry queues. Payment processing abstraction shows particular skill with uniform CRUD interfaces across gateways. Active maintenance is evident through frequent releases, Dependabot integration, and responsive issue triage. While complexity arises from extensive feature set and payment integrations, the modular design contains coupling effectively. Technical drift is low due to current Python version (3.13), updated dependencies, and proactive schema migrations.
This is the Microsoft FAST monorepo, a standards-based web component framework. It provides a lightweight, performant foundation for building custom elements with declarative templates, reactive data binding, server-side rendering (SSR), and hydration. The core library `@microsoft/fast-element` offers a complete runtime with observability, templating, dependency injection, and state management. Companion packages include a client-side router (`fast-router`), a test harness (`fast-test-harness`), and Rust-based build tools (`fast-build`, `fast-convert`) for SSR and template syntax conversion. The repository also contains example applications (CSR todo, SSR chat, WebUI todo), extensive Playwright integration tests, and a benchmark suite measuring rendering performance. The architecture is modular, with clear separation between runtime, build-time, and testing concerns. The codebase demonstrates high craftsmanship in areas like reactive observation, template compilation, hydration, and dependency injection, though some experimental features and cross-language (Rust/TypeScript) coordination introduce maintenance complexity.
tsshd is a UDP-based SSH server (and Go library) designed for unreliable networks, providing seamless client roaming and auto-reconnect. It works in conjunction with the tssh client (trzsz-ssh). The architecture is session-based: a standard SSH login spawns a tsshd process that listens on a UDP port (using KCP or QUIC transport), then the client switches to UDP communication, surviving network changes and temporary disconnections. The codebase implements a full-featured SSH replacement: session management, port forwarding (TCP/UDP), X11 and agent forwarding, terminal attach/detach, and a middleware system for custom session handlers. It also includes a reusable client library (SshUdpClient) for building custom SSH applications with roaming support. The project is well-maintained with extensive test coverage, CI/CD, and multi-platform support (Linux, macOS, Windows, FreeBSD).
Vue Select is a mature, zero-dependency Vue 2 component library that implements a feature-rich select/dropdown/typeahead UI element. It supports single and multiple selection, tagging, AJAX-powered search, keyboard navigation, RTL, and extensive customization via slots, props, CSS variables, and child component overrides. The library is distributed via npm and can be used as a Vue plugin or global component. The architecture is centered around a single large Vue component (Select.vue) that composes mixins for type-ahead pointer management, auto-scrolling, and AJAX loading, plus child components for the clear button and open indicator. It follows WAI-ARIA practices for accessibility and includes a complete set of unit tests. While the component is tightly coupled internally, it exposes a well-documented API for external configuration. The codebase is actively maintained with semantic release, bundle size monitoring, and a separate Vue 3 beta branch.
presenterm is a Rust-based CLI application that renders Markdown presentations directly in the terminal. It parses Markdown into a structured intermediate representation via comrak, then builds slides as sequences of render operations. The rendering engine supports rich text, images, code highlighting through bat/syntect, column layouts, themes, slide transitions, footers, speaker notes, and interactive keyboard-driven navigation. It also includes PDF/HTML export backends and hot-reload for live presentation development.
diagram-js is a modular, extensible JavaScript library for building interactive web-based diagram editors. It provides the foundational infrastructure—an event-driven architecture via EventBus, a command pattern with full undo/redo support via CommandStack, and a DI container (didi) for composing features as independent modules. The codebase includes core services (Canvas, ElementRegistry, GraphicsFactory) for managing SVG rendering, hit testing, and element lifecycle, along with a rich set of interaction features: drag-and-drop creation/move/resize/connect, snapping, grid snapping, auto-resize, auto-place, bendpoint editing, lasso selection, space tool, popup menus, context pads, palettes, search, overlays, copy/paste, and keyboard bindings. It is designed for downstream domain-specific editors (e.g., bpmn-js, dmn-js) which extend it via provider interfaces and rule systems. The library is well-tested with an extensive suite using Mocha/Chai/Sinon and runs on modern browsers. Its architecture emphasizes decoupling, extensibility, and reusable patterns.
IINA is a modern macOS media player built on the mpv framework. It provides a native macOS interface for playing local and online media, with features including subtitle support, playlist management, Touch Bar integration, picture-in-picture mode, and a JavaScript-based plugin system for extensibility. The application follows a modular architecture separating playback core (PlayerCore), UI components, preference management, plugin system, and utilities. Key strengths include a well-crafted threading system (Atomic/ReadWriteAtomic property wrappers), structured logging, and a preference observation pattern. While the core PlayerCore class exhibits some complexity, the overall codebase demonstrates professional macOS development practices with clean abstractions in utility modules and extensibility points.
pgflow is a PostgreSQL/Supabase-native workflow orchestration engine for defining and executing typed DAGs as background jobs. The system is split into six coordinated packages: a PL/pgSQL core (pkgs/core) that implements the complete workflow state machine in the database — flows, steps, runs, step states, tasks, retries with exponential backoff, map/reduce fan-out, conditional step execution, skip-cascade propagation, and realtime event broadcasting — plus a type-safe TypeScript DSL (pkgs/dsl) for declaring flows with compile-time-enforced inputs/outputs, a Deno/edge worker runtime (pkgs/edge-worker) that consumes PGMQ messages and executes step handlers via platform adapters (Supabase vs. plain process), a realtime-subscription client library (pkgs/client), and a CLI (pkgs/cli) for scaffolding new Supabase projects. Execution relies on pgmq for task queues, pg_cron for stalled-task recovery and worker health, pg_net for HTTP worker invocation, supabase_vault for credentials, and Supabase Realtime for atomic state-transition broadcasts.
lua-resty-redis is a Lua Redis client driver for OpenResty/ngx_lua, leveraging the cosocket API for fully non-blocking I/O. It implements the Redis wire protocol (RESP) to support all standard Redis commands, including pipelining, transactions, pub/sub, and SSL connections. The library provides automatic method generation via Lua metatables, allowing any Redis command to be called as a method without explicit registration. It also offers connection pooling, Unix socket support, and configurable timeouts. The single source file (lib/resty/redis.lua) is self-contained and can be dropped into any OpenResty project. The codebase demonstrates strong engineering practices with efficient table reuse, proper error handling, and comprehensive test coverage.
GSAP (GreenSock Animation Platform) is a mature, high-performance JavaScript animation library designed for creating complex animations in web applications. It features a plugin-based architecture where the core tweening engine is extended by plugins for specific animation types such as CSS, scroll-based motions, SVG morphing, and physics effects. The library is framework-agnostic and supports animation of CSS properties, SVG attributes, canvas objects, and JavaScript objects. The source code reveals a well-structured codebase with clear separation of concerns. Core animation logic resides in gsap-core.js, while utilities (matrix operations, string handling, path parsing, velocity tracking) are isolated in the utils directory. Plugins follow a consistent registration pattern and demonstrate attention to cross-browser compatibility, performance optimization (including requestAnimationFrame usage and tree shaking protection), and modular design. The library is actively maintained with recent updates and extensive TypeScript support.
MQTT.js is a comprehensive MQTT protocol client library for Node.js and browsers, implementing MQTT 3.1.1 and 5.0 specifications. It provides core functionality for connecting to brokers, publishing/subscribing with QoS levels, keepalive management, and offline message queuing. The architecture features modular transport abstraction (TCP/TLS/WebSocket/platform-specific), event-driven design with TypedEventEmitter, and pluggable persistence via Store. Entry points include the main library (src/mqtt.ts), CLI tools (src/bin/*), and platform-specific adapters. The codebase demonstrates strong craftsmanship in handling protocol complexities, cross-platform concerns, and maintainable abstractions.
ElegantOTA is an Arduino library that provides a polished web-based portal for over-the-air (OTA) firmware and filesystem updates on wireless microcontrollers (ESP8266, ESP32, RP2040+WiFi, RP2350+WiFi). The library exposes a minimal C++ API (begin, loop, callbacks) and serves a gzipped HTML/CSS/JS portal at /update. It handles the entire OTA workflow: capacity check before upload, MD5 integrity verification, chunked writing, progress reporting, and automatic reboot. The code is well-structured with platform-specific abstractions via preprocessor macros, supporting both synchronous (WebServer) and asynchronous (ESPAsyncWebServer) modes. The repository includes comprehensive CI testing across multiple boards and toolchains (Arduino CLI, PlatformIO), a CLA assistant, and stale issue management. The library is actively maintained with recent bug fixes (MD5 verification, RP2040 space calculation) and a clear upgrade path to a commercial Pro version.
Newspipe is a self-hosted web news aggregator (RSS/Atom feed reader) built with Flask. It provides a full-featured reading experience with multi-user support, two-factor authentication, role-based access control, and a RESTful API. The system fetches feeds asynchronously using asyncio, sanitizes content against XSS, and guards against SSRF via IP pinning. It supports categories, bookmarks, tags, notes, search, infinite scroll, and a resizable reading pane. Data can be imported/exported in OPML and JSON formats, and it integrates with Pinboard for bookmark import. The frontend uses Bootstrap 5, Chart.js, and Luxon for relative dates, with i18n support for English, French, and German. The architecture follows a layered pattern: Flask blueprints for views, controllers for data access (with a generic AbstractController), SQLAlchemy models, and utility libraries for security and data handling. The crawler is a separate async module that can be invoked via CLI or cron. The codebase demonstrates strong security practices (CSP, CSRF, safe redirects, input sanitization) and includes unit tests for security-critical components. While the project is well-structured and actively maintained, there is a known bug where non-admin users with API access cause a 500 error on article updates due to a tag association proxy issue.
Grid.js is a TypeScript table library that renders interactive HTML tables with features like sorting, searching, pagination, and row/cell selection. It follows a modular architecture with clear separation of concerns: core grid functionality, configuration system, data pipeline for processing data through stages (extraction, transformation, filtering, sorting, limiting), storage abstraction for client/server data sources, UI components built with Preact, and a plugin system for extensibility. Data flows from user-provided sources through storage adapters, then through pipeline processors that handle server initiation, data extraction, format transformation, filtering, sorting, and pagination before reaching the view layer for rendering. User interactions trigger pipeline reprocessing to update the display.
SRS (Simple Realtime Server) is a high-performance, multi-protocol media streaming server primarily written in C++ with a newer Go-based proxy component (SRSX). It ingests, processes, and delivers live audio/video streams via RTMP, WebRTC (WHIP/WHEP), HLS, HTTP-FLV, SRT, and GB28181. The core C++ engine uses a coroutine model built on state-threads, implements stream forwarding, transcoding via FFmpeg, and provides a full HTTP API for management. The Go proxy component (cmd/proxy, internal/) adds load balancing, Redis integration, and protocol proxying for RTMP/HTTP/WebRTC, designed to scale origin/edge deployments. The repository also includes extensive research code, blackbox integration tests, and vendored third-party libraries (FFmpeg 4, OpenSSL 1.1, gperftools, SRT, libsrtp) that have been customized with a '-fit' suffix. This hybrid architecture is actively developed with multiple CI workflows and a large test suite, though some vendored dependencies are older and may require security updates.
omni-article-markdown is a CLI tool and library that converts web articles from various sources into clean Markdown format. It employs a modular pipeline architecture: Reader fetches HTML (using requests or Playwright for JavaScript-heavy sites), Extractor isolates article content by removing boilerplate and ads, and Parser converts the cleaned HTML to Markdown with support for code blocks, tables, math equations, and GitHub Gists. The system uses a plugin-based architecture where site-specific readers and extractors are automatically discovered and loaded, allowing easy extension for new websites. Key features include SSL verification control, cookie persistence for sites requiring authentication (like Zhihu), and flexible output options (stdout or file saving).
Ratpack is a high-performance, non-blocking web framework for Java built on top of Netty. It provides a unique asynchronous execution model based on Promise and ExecController, a flexible handler chain for HTTP request processing, and a hierarchical Registry for dependency injection. The framework is highly modular, offering optional integrations for Guice, Spring Boot, Groovy DSL, reactive streams (RxJava 2, Project Reactor), templating (Handlebars, Thymeleaf), metrics (Dropwizard), and session management. Its architecture demonstrates strong engineering craftsmanship, particularly in its ground-up reactive streams implementation and its functional programming primitives designed to handle checked exceptions. While the core is modern and well-maintained, some integrations (Guice, Groovy) reflect the era of its initial design, contributing to a medium level of technical drift.
Gitleaks is a command-line secret detection tool written in Go that scans for sensitive information like API keys, tokens, and passwords in git repositories, directories, files, and stdin. It features a modular architecture with separate components for configuration loading, source abstraction (file/git/archive handling), detection logic with multi-layer decoding, rule-based matching, and flexible reporting. The tool uses a Cobra-based CLI interface with commands for different scan modes and supports output formats including JSON, CSV, JUnit, SARIF, and custom templates. Key strengths include its pluggable decoder pipeline for handling encoded secrets, configurable rule system with entropy checks and keyword filtering, and sophisticated allowlist mechanism for reducing false positives. While actively maintained for security patches, the project is feature-complete with ongoing dependency management challenges due to its extensive rule set and reliance on unstable packages like golang.org/x/exp.
This is a Nuxt 3 module that integrates Cloudflare Turnstile, a privacy-focused CAPTCHA alternative. It provides a Vue component (`<NuxtTurnstile>`) for client-side rendering of the Turnstile widget, a composable (`useScriptCloudflareTurnstile`) for script loading via `@nuxt/scripts`, and a server-side utility (`verifyTurnstileToken`) for token validation in Nitro endpoints. The module automatically handles script injection, token refresh, and exposes a reset method. It also supports an optional validation endpoint at `/_turnstile/validate`. The architecture follows the standard Nuxt module pattern: `src/module.ts` registers components, composables, and server handlers. External dependencies include Cloudflare's Turnstile API, `@nuxt/scripts`, `@nuxt/kit`, `defu`, and `pathe`. The codebase is well-structured, typed, and includes end-to-end tests with Playwright.