Scan report

Mechaguy06 / MalDet-Commercial-Website

View on GitHub (opens in a new tab)
CSS
0 stars
Scanned 29 Oct 2026, 07:05

Report Rescan

Vulnerability Low

Could an attacker exploit mistakes in this code?

10 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 1
Medium: 0
Low: 0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Low

Does this code look like it is trying to cause harm?

3 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 0
Medium: 1
Low: 12

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

14 total findings

Likely real: 2
Uncertain: 0
Likely noise: 12

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

2 findings likely need attention, 12 look like noise. Most notable: This Node.js version file pins a runtime that is affected by CVE-2026-111497 (Brotli de... in /.mise.toml (95% confidence).

Detections by engine

Dependency checker 12

CVEs, typosquats and risky installs · Supply chain
Semgrep 1

Pattern-based code analysis · Vulnerability
GuardDog 1

Supply-chain attack heuristics · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.mise.toml line 2

Likely real
Yes, 95% confidence

This Node.js version file pins a runtime that is affected by CVE-2026-111497 (Brotli decoder out-of-bounds write, remote code execution) or a floating alias whose patch level cannot be verified. Pin to a fixed release: 22.23.4, 24.22.1, 26.12.1 or later on the same line. Node.js 20 and older, 23 and 25 are end-of-life and will not receive a fix.
```
node = "22"
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/src/App.tsx line 4

Likely real
Yes, 98% confidence

Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration]
```
const MALDET_URL = "http://103.233.1.97:5000/"

type Page = "about" | "documentation" | "contact"
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'lenis^1.3.27' — attacker could push malicious update
```
lenis:^1.3.27
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'react^19.0.0' — attacker could push malicious update
```
react:^19.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'react-dom^19.0.0' — attacker could push malicious update
```
react-dom:^19.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@tailwindcss/vite^4.0.0' — attacker could push malicious update
```
@tailwindcss/vite:^4.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@types/node^22.0.0' — attacker could push malicious update
```
@types/node:^22.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@types/react^19.0.0' — attacker could push malicious update
```
@types/react:^19.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@types/react-dom^19.0.0' — attacker could push malicious update
```
@types/react-dom:^19.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@vitejs/plugin-react^6.0.0' — attacker could push malicious update
```
@vitejs/plugin-react:^6.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'oxfmt^0.2.0' — attacker could push malicious update
```
oxfmt:^0.2.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'tailwindcss^4.0.0' — attacker could push malicious update
```
tailwindcss:^4.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'typescript^5.7.0' — attacker could push malicious update
```
typescript:^5.7.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'vite^8.0.5' — attacker could push malicious update
```
vite:^8.0.5
```