The Problem

Enterprises and power users need a trustworthy way to reclaim disk space, remove lingering app data, and scan for malware on Windows, macOS, and Linux. Existing cleaners are often closed‑source, bundled with ads, or require paid upgrades, leaving security teams unable to audit what is being deleted.

What This Does

Kudu is an open‑source Electron application that bundles a system‑cleaner, privacy‑shield, and malware scanner. The core logic lives under src/main/ (the Electron main process) and src/renderer/ (the React UI).

  • The CLI entry point src/main/cli.ts exposes commands such as scanApp, scanBrowserCli, and scanGaming.
  • Platform‑specific code lives in src/main/platform/ (e.g., darwin/, linux/).
  • Shared type definitions and IPC channel names are defined in src/shared/types.ts and src/shared/channels.ts, which are imported by > 60 other modules.

All cleaners (e.g., src/main/ipc/disk-analyzer.ipc.ts, src/main/ipc/malware-scanner.ipc.ts) implement a common IPC contract and are invoked from the UI or CLI.

How It Is Wired

Execution starts at CLI (src/main/cli.ts) or the Electron main entry (src/main/index.ts).

  1. CLI parses arguments, then calls the high‑level helper scanApp (≈ 63 functions) which eventually invokes t (the i18n helper from src/main/i18n.ts). t is the most‑referenced function (called from 145 places).
  2. Renderer boots src/renderer/src/App.tsx, which creates the React tree and loads the IPC bridge. UI components such as MalwareScannerPage repeatedly call t to render localized strings.
  3. UI actions trigger IPC calls (e.g., src/main/ipc/malware-scanner.ipc.ts). These modules import shared types (src/shared/types.ts) and channel constants (src/shared/channels.ts). Both files act as hub modules (66 and 46 importers respectively), so any change propagates widely.
  4. Platform‑specific services (src/main/platform/darwin/*, src/main/platform/linux/*) are loaded via src/main/platform/index.ts. This file participates in an import cycle with src/main/ipc/index.ts and src/main/services/elevation.ts, increasing the risk of subtle runtime errors.
  5. Core work (file deletion, registry edits, network cleanup) is performed by functions such as execUtf8 (src/main/services/exec-utf8.ts), psUtf8, and execNativeUtf8. These are called from many IPC modules (e.g., disk-analyzer, duplicate-finder).

External effects are limited: only three functions write to a local database, one touches the file system, and one makes an outbound network request. The call graph shows 2 374 internal edges, with a few high‑impact functions (t, invoke, getPlatform) acting as thin wrappers around the substantive service code.

How To Use It

# Clone the repo
git clone https://github.com/moses-y/kudu.git
cd kudu

# Install dependencies (npm is declared in package.json)
npm ci

# Run the CLI (example: scan the whole system)
node ./src/main/cli.js scanApp

# Start the full Electron UI (script defined in package.json, e.g. npm start)
npm start

Configuration: No environment variables are required out‑of‑the‑box. Platform‑specific paths are resolved by the code in src/main/platform/*.

Database: The SQLite‑style store is used by src/main/services/cloud-agent.ts and src/main/cli.ts; no external setup is needed.

Real‑World Use

A DevOps team can embed Kudu in a nightly maintenance pipeline:

npm run start -- --headless clean --log /var/log/kudu.log

The CLI runs the same cleaners the UI uses, writes a summary to the local DB, and returns an exit code that can be consumed by orchestration tools.

Code Health & Issues

  • High – Pin third‑party GitHub Actions to a commit SHA (.github/workflows/*).
  • Medium – Add a dependency‑vulnerability gate in CI (.github/workflows/*).
  • Medium – Set persist-credentials: false on the checkout step (.github/workflows/ci.yml).
  • Low – Define timeout-minutes for jobs lacking it (.github/workflows/commitlint.yml).

Additional static findings (all high severity) include:

  • Oversized files (src/shared/types.ts, src/main/services/cloud-agent.ts, src/main/services/software-updater.ts) > 1 000 lines, making changes risky.
  • Import cycles (28 files, e.g., src/main/ipc/index.ts, src/main/platform/index.ts).
  • Deep nesting (up to 8 levels) in several renderer pages, hurting readability.
  • Repeated 6‑line code blocks across dozens of scripts and source files, indicating DRY violations.

No critical security or licensing gaps were detected; tests, CI, and a LICENSE file are present.

The Bottom Line

Kudu provides a fully open‑source, cross‑platform cleaning and scanning stack with a clear separation between UI, IPC, and platform services. The codebase is functional but hampered by large monolithic files, import cycles, and duplicated helpers, which raise the maintenance burden. Teams comfortable with TypeScript and Electron can adopt it for internal tooling, but should first refactor hub modules and break cycles to improve long‑term stability.