Scan report
aimeos / pagible
Could an attacker exploit mistakes in this code?
No issues of this kind were found.
- High
- 0
- Medium
- 0
- Low
- 0
Sources: Bandit, Semgrep, pip-audit
Does this code look like it is trying to cause harm?
Minor issues. Worth a glance, unlikely to be urgent.
- High
- 5
- Medium
- 0
- Low
- 1
Sources: YARA, ClamAV, GuardDog, dependency checker
- Likely real
- 0
- Uncertain
- 0
- Likely noise
- 6
The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.
What we found, in plain English
All 6 findings look like noise (low confidence) — nothing here likely needs attention.
Detections by engine
Findings
Highest severity first. Select a finding to see the code and what it means.
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /admin/dist/assets/ckeditor5-BYmxVf0w.js
- Likely real
- Probably noise, 3% confidence
YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /admin/dist/assets/markdown-dX40KXqD.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /admin/dist/assets/pusher-CbCVjao4.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /admin/dist/assets/graphql-C4Y4hVTz.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /admin/dist/assets/ckeditor5-BYmxVf0w.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- package.json
- Likely real
- Probably noise, 2% confidence
Loose version constraint: '@playwright/test^1.50' — attacker could push malicious update
@playwright/test:^1.50
No findings match these filters.