Scan report
fusionpbx / fusionpbx
Could an attacker exploit mistakes in this code?
No issues of this kind were found.
- High
- 0
- Medium
- 0
- Low
- 0
Sources: Bandit, Semgrep, pip-audit
Does this code look like it is trying to cause harm?
Serious issues. Review the high-severity findings before using it.
- High
- 41
- Medium
- 2
- Low
- 8
Sources: YARA, ClamAV, GuardDog, dependency checker
- Likely real
- 11
- Uncertain
- 1
- Likely noise
- 39
The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.
What we found, in plain English
This repository has been flagged as having a high malicious-pattern score of 37.0, which indicates that the code contains intentional signs of malicious intent rather than just standard insecure coding practices. The most concerning issues are several instances of dangerous download-and-execute patterns, including downloading remote files and executing them directly, combined with specific YARA rules that detect encoded payloads being decoded and run immediately. These findings suggest that attackers could potentially use this code to perform actions like process injection or credential dumping by leveraging these built-in capabilities. While some low-severity issues exist regarding memory scraping and environment variable reading, the presence of high-confidence malicious patterns means the repository should not be used in a production environment without significant additional security review and mitigation efforts.
Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.
Detections by engine
Score over time
Overall score each time this repository was scanned.
Findings
Highest severity first. Select a finding to see the code and what it means.
-
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /resources/ace/mode-powershell.js line 1
- Likely real
- Yes, 95% confidence
Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec]
...ect|Import-Alias|Import-Clixml|Import-Csv|Import-LocalizedData|Import-PSSession|Invoke-Expression|Invoke-RestMethod|Invoke-WebRequest|Measure-Command|Measure-Object|New-Alias|New-Event|New-Object|New-TimeSpan|New-Variable|Out-File|Out-GridView|Out-P... -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /resources/ace/mode-autohotkey.js line 1
- Likely real
- Yes, 94% confidence
Detects keylogging and input capture patterns [threat-runtime-keylogging]
...inAPI_SetProcessAffinityMask|WinAPI_SetSysColors|WinAPI_SetTextColor|WinAPI_SetWindowLong|WinAPI_SetWindowPos|WinAPI_SetWindowsHookEx|WinAPI_SetWindowText|WinAPI_ShowCursor|WinAPI_ShowError|WinAPI_ShowMsg|WinAPI_ShowWindow|WinAPI_StringFromGUID|WinAP... -
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/ace/mode-autohotkey.js
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_process_injection — Windows process-injection API sequence
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/ace/worker-coffee.js
- Likely real
- Probably noise, 3% confidence
YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /readme.md
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/ace/mode-php.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/ace/mode-php_laravel_blade.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /app/email_queue/resources/functions/transcribe.php
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /core/contacts/contact_auth.php
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /core/contacts/contact_import_google.php
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/jquery/jquery-3.6.1.min.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/ace/ace.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/jquery/jquery-ui.min.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/momentjs/moment-with-locales.min.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/ace/worker-xml.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/ace/worker-css.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/ace/keybinding-vim.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/ace/ext-chromevox.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/ace/worker-yaml.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/ace/worker-lua.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/ace/worker-html.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/ace/worker-javascript.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/tcpdf/include/tcpdf_static.php
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/templates/engine/smarty/plugins/function.mailto.php
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/jquery/jquery-qrcode.min.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /core/upgrade/upgrade_menu.php
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/ace/ext-settings_menu.js
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/ace/ext-prompt.js
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/ace/ext-options.js
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/ace/mode-powershell.js
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/ace/ext-modelist.js
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /resources/phpmailer/docs.ini
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /app/fax_queue/resources/service/debian/fax_queue.service
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /app/system/resources/service/debian/system_status.service
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /app/operator_panel/resources/service/operator_panel.php
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /app/email_queue/resources/service/debian/email_queue.service
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /app/event_guard/resources/service/debian/event_guard.service
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /app/xml_cdr/resources/service/debian/xml_cdr.service
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /core/upgrade/upgrade.php
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /core/services/resources/classes/services.php
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /core/websockets/resources/service/debian/websockets.service
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /resources/momentjs/moment-with-locales.js line 10741
- Likely real
- Yes, 98% confidence
Detects unicode homoglyphs and uncommon characters used for obfuscation [threat-runtime-obfuscation-unicode]
L : 'YYYY-MM-DD', LL : 'YYYY оны MMMMын D', LLL : 'YYYY оны MMMMын D HH:mm', LLLL : 'dddd, YYYY оны MMMMын D HH:mm' -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /resources/ace/snippets/edifact.js line 1
- Likely real
- Yes, 96% confidence
Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]
...dById(${3});${4}\n##\n## Javadocs\nsnippet /**\n /**\n * ${1}\n */\nsnippet @au\n @author `system("grep \\`id -un\\` /etc/passwd | cut -d \\":\\" -f5 | cut -d \\",\\" -f1")`\nsnippet @br\n @brief ${1:Description}\nsnippet @fi\n @file ${1:`Filename... -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /resources/ace/worker-coffee.js line 1
- Likely real
- Yes, 93% confidence
Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
...("undefined"!=typeof process&&null!==process?null==(n=process.env)?void 0:n.DEBUG_TOKEN_STREAM:void 0)&&(process.env.DEBUG_REWRITTEN_TOKEN_STREAM&&console.log("Initial token stream:"),console.log(function(){var e,t,n,r;for(n=this.tokens,r=[],e=0,t=n.... -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /resources/ace/worker-coffee.js line 1
- Likely real
- Yes, 93% confidence
Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
...efined"!=typeof process&&null!==process?null==(r=process.env)?void 0:r.DEBUG_REWRITTEN_TOKEN_STREAM:void 0)&&(process.env.DEBUG_TOKEN_STREAM&&console.log("Rewritten token stream:"),console.log(function(){var e,t,n,r;for(n=this.tokens,r=[],e=0,t=n.len... -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /resources/ace/mode-autohotkey.js line 1
- Likely real
- Yes, 92% confidence
Detects DLL injection and process injection techniques [threat-process-injection-dll]
...I_WaitForSingleObject|WinAPI_WideCharToMultiByte|WinAPI_WindowFromPoint|WinAPI_WriteConsole|WinAPI_WriteFile|WinAPI_WriteProcessMemory|WinNet_AddConnection|WinNet_AddConnection2|WinNet_AddConnection3|WinNet_CancelConnection|WinNet_CancelConnection2|W... -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /resources/ace/mode-autohotkey.js line 1
- Likely real
- Yes, 92% confidence
Detects DLL injection and process injection techniques [threat-process-injection-dll]
...loc|MemGlobalFree|MemGlobalLock|MemGlobalSize|MemGlobalUnlock|MemMoveMemory|MemMsgBox|MemShowError|MemVirtualAlloc|MemVirtualAllocEx|MemVirtualFree|MemVirtualFreeEx|Min|MouseTrap|NamedPipes_CallNamedPipe|NamedPipes_ConnectNamedPipe|NamedPipes_CreateN... -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /resources/ace/mode-autohotkey.js line 1
- Likely real
- Yes, 92% confidence
Detects memory scraping and credential dumping from process memory [threat-process-memory]
...API_OpenProcess|WinAPI_PointFromRect|WinAPI_PostMessage|WinAPI_PrimaryLangId|WinAPI_PtInRect|WinAPI_ReadFile|WinAPI_ReadProcessMemory|WinAPI_RectIsEmpty|WinAPI_RedrawWindow|WinAPI_RegisterWindowMessage|WinAPI_ReleaseCapture|WinAPI_ReleaseDC|WinAPI_S... -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /resources/ace/mode-autohotkey.js line 1
- Likely real
- Yes, 92% confidence
Detects memory scraping and credential dumping from process memory [threat-process-memory]
...f|Security__IsValidSid|Security__LookupAccountName|Security__LookupAccountSid|Security__LookupPrivilegeValue|Security__OpenProcessToken|Security__OpenThreadToken|Security__OpenThreadTokenEx|Security__SetPrivilege|Security__SidToStringSid|Security__S... -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /resources/ace/mode-autohotkey.js line 1
- Likely real
- Yes, 92% confidence
Detects memory scraping and credential dumping from process memory [threat-process-memory]
...Find|GUICtrlEdit_FmtLines|GUICtrlEdit_GetFirstVisibleLine|GUICtrlEdit_GetLimitText|GUICtrlEdit_GetLine|GUICtrlEdit_GetLineCount|GUICtrlEdit_GetMargins|GUICtrlEdit_GetModify|GUICtrlEdit_GetPasswordChar|GUICtrlEdit_GetRECT|GUICtrlEdit_GetRECTEx|GUICtrlEdit_GetSel|GUICtrlEdit_GetText|GUICtrlEdit_GetTextLen|GUICtrlEdit_HideBalloonTip|GUICtrlEdit_InsertText|GUICtrlEdit_LineFromChar|GUICtrlEdit_LineIndex|GUICtrlEdit_LineLength|GUICtrlEdit_LineScroll|GUICtrlEdit_PosFromChar|GUICtrlEdit_ReplaceSel|GUICtrlEdit_Scrol... -
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /readme.md
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
No findings match these filters.