Scan report

home-assistant / core

View on GitHub (opens in a new tab)
Python
91283 stars
Scanned 07 Oct 2026, 05:08

Report Rescan

Vulnerability Safe

Could an attacker exploit mistakes in this code?

0 risk score

No issues of this kind were found.

High: 0
Medium: 0
Low: 0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern High

Does this code look like it is trying to cause harm?

86 risk score

Serious issues. Review the high-severity findings before using it.

High: 16
Medium: 10
Low: 45

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

71 total findings

Likely real: 15
Uncertain: 3
Likely noise: 53

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

The repository has a very low vulnerability score of 0.0, which means there are no obvious code errors that could be easily exploited by attackers. However, the high malicious-pattern score of 86.0 indicates that the code contains many signs of intentional bad behavior rather than just standard mistakes. The most serious issues involve potential credential harvesting and download-and-execute attacks, as well as suspicious dependencies like typosquatting names for popular libraries. These findings suggest the code may be actively trying to steal secrets or run malicious scripts, which is a much more dangerous situation than simple insecure coding patterns.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

YARA 48

Malware signature rules · Malicious pattern
GuardDog 12

Supply-chain attack heuristics · Malicious pattern
Dependency checker 11

CVEs, typosquats and risky installs · Supply chain

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/homeassistant/components/keyboard_remote/__init__.py line 182

Likely real
Yes, 94% confidence

Detects keylogging and input capture patterns [threat-runtime-keylogging]
```
try:
            dev = InputDevice(descriptor)
        except OSError:
            return (None, None)
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/homeassistant/components/keyboard_remote/__init__.py line 10

Likely real
Yes, 94% confidence

Detects keylogging and input capture patterns [threat-runtime-keylogging]
```
from asyncinotify import Inotify, Mask
from evdev import InputDevice, categorize, ecodes, list_devices
import probatio
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/homeassistant/components/keyboard_remote/__init__.py line 344

Likely real
Yes, 94% confidence

Detects keylogging and input capture patterns [threat-runtime-keylogging]
```
async for event in self.dev.async_read_loop():
                    if event.type is ecodes.EV_KEY:
                        if event.value in self.key_values:
                            _LOGGER.debug(
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Yes, 90% confidence

Typosquatting: 'httpx2' is suspiciously similar to 'httpx'
```
httpx2==2.13.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
requirements.txt line 32

Likely real
Yes, 90% confidence

Typosquatting: 'httpx2' is suspiciously similar to 'httpx'
```
httpx2==2.13.1
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/homeassistant/components/nmap_tracker/__init__.py line 12

Likely real
Yes, 98% confidence

Detects extensive system/network enumeration activities [threat-runtime-enumeration]
```
from getmac import get_mac_address
from nmap import PortScanner, PortScannerError

from homeassistant.components.device_tracker import (
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/homeassistant/components/nmap_tracker/__init__.py line 294

Likely real
Yes, 98% confidence

Detects extensive system/network enumeration activities [threat-runtime-enumeration]
```
await self._async_run_nmap_scan()
            except PortScannerError as ex:
                _LOGGER.error("Nmap scanning failed: %s", ex)
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/homeassistant/components/nmap_tracker/__init__.py line 326

Likely real
Yes, 98% confidence

Detects extensive system/network enumeration activities [threat-runtime-enumeration]
```
if not self._scanner:
            self._scanner = PortScanner()
        _LOGGER.debug("Scanning %s with args: %s", self._hosts, options)
        for attempt in range(MAX_SCAN_ATTEMPTS):
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/homeassistant/const.py line 561

Likely real
Yes, 98% confidence

Detects unicode homoglyphs and uncommon characters used for obfuscation [threat-runtime-obfuscation-unicode]
```
MICROAMPERE = "μA"
    MILLIAMPERE = "mA"
    AMPERE = "A"
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/homeassistant/components/marketplace/data_client.py line 113

Likely real
Yes, 98% confidence

Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration]
```
endpoint = f"{section}/data.json"
        url = f"https://data-v2.hacs.xyz/{endpoint}"
        try:
            async with self._session.get(
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/homeassistant/components/telegram_bot/const.py line 29

Likely real
Yes, 98% confidence

Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration]
```
DEFAULT_TIMEOUT_SECONDS = 1800  # 30 minutes
DEFAULT_API_ENDPOINT = "https://api.telegram.org"
DEFAULT_TRUSTED_NETWORKS = [ip_network("149.154.160.0/20"), ip_network("91.108.4.0/22")]
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/homeassistant/components/marketplace/system_health.py line 46

Likely real
Yes, 98% confidence

Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration]
```
"catalog_data": system_health.async_check_can_reach_url(
            hass, "https://data-v2.hacs.xyz/data.json", CLOUDFLARE_STATUS
        ),
        "github_connected": marketplace.github_connected,
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/homeassistant/components/route53/__init__.py line 98

Likely real
Yes, 97% confidence

Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links]
```
try:
        ipaddress = requests.get("https://api.ipify.org/", timeout=5).text

    except requests.RequestException:
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/homeassistant/components/telegram_bot/const.py line 29

Likely real
Yes, 97% confidence

Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links]
```
DEFAULT_TIMEOUT_SECONDS = 1800  # 30 minutes
DEFAULT_API_ENDPOINT = "https://api.telegram.org"
DEFAULT_TRUSTED_NETWORKS = [ip_network("149.154.160.0/20"), ip_network("91.108.4.0/22")]
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
requirements.txt line 3

Likely real
Yes, 54% confidence

Unpinned dependency: '-c homeassistant/package_constraints.txt' has no version lock — supply chain risk
```
-c homeassistant/package_constraints.txt
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'typing-extensions>=4.16.0,<5.0' — attacker could push malicious update
```
typing-extensions>=4.16.0,<5.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
requirements.txt line 39

Likely real
Probably noise, 2% confidence

Loose version constraint: 'packaging>=23.1' — attacker could push malicious update
```
packaging>=23.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
requirements.txt line 58

Likely real
Probably noise, 2% confidence

Loose version constraint: 'typing-extensions>=4.16.0,<5.0' — attacker could push malicious update
```
typing-extensions>=4.16.0,<5.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
requirements.txt line 60

Likely real
Probably noise, 2% confidence

Loose version constraint: 'urllib3>=2.0' — attacker could push malicious update
```
urllib3>=2.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'certifi>=2021.5.30' — attacker could push malicious update
```
certifi>=2021.5.30
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'packaging>=23.1' — attacker could push malicious update
```
packaging>=23.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'urllib3>=2.0' — attacker could push malicious update
```
urllib3>=2.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
requirements.txt line 21

Likely real
Probably noise, 2% confidence

Loose version constraint: 'certifi>=2021.5.30' — attacker could push malicious update
```
certifi>=2021.5.30
```