Scan report
NayakwadiS / mftool
Could an attacker exploit mistakes in this code?
Minor issues. Worth a glance, unlikely to be urgent.
- High
- 0
- Medium
- 2
- Low
- 0
Sources: Bandit, Semgrep, pip-audit
Does this code look like it is trying to cause harm?
Minor issues. Worth a glance, unlikely to be urgent.
- High
- 0
- Medium
- 7
- Low
- 0
Sources: YARA, ClamAV, GuardDog, dependency checker
- Likely real
- 6
- Uncertain
- 1
- Likely noise
- 2
The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.
What we found, in plain English
6 findings likely need attention, 2 look like noise. Most notable: Unpinned dependency: 'pandas' has no version lock — supply chain risk in requirements.txt (54% confidence).
Detections by engine
Findings
Highest severity first. Select a finding to see the code and what it means.
-
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- requirements.txt line 4
- Likely real
- Yes, 54% confidence
Unpinned dependency: 'pandas' has no version lock — supply chain risk
pandas -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- requirements.txt line 5
- Likely real
- Yes, 54% confidence
Unpinned dependency: 'yfinance' has no version lock — supply chain risk
yfinance -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- requirements.txt line 6
- Likely real
- Yes, 54% confidence
Unpinned dependency: 'matplotlib' has no version lock — supply chain risk
matplotlib -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- requirements.txt line 7
- Likely real
- Yes, 54% confidence
Unpinned dependency: 'deprecated' has no version lock — supply chain risk
deprecated -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- requirements.txt line 2
- Likely real
- Yes, 54% confidence
Unpinned dependency: 'bs4' has no version lock — supply chain risk
bs4 -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- requirements.txt line 3
- Likely real
- Yes, 54% confidence
Unpinned dependency: 'httpx' has no version lock — supply chain risk
httpx -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- requirements.txt line 1
- Likely real
- Uncertain, 41% confidence
Unpinned dependency: 'requests' has no version lock — supply chain risk
requests -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /mftool.py
- Likely real
- Probably noise, 21% confidence
Call to requests without timeout
-
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /mftool.py
- Likely real
- Probably noise, 21% confidence
Call to requests without timeout
No findings match these filters.