Scan report
opentofu / opentofu
Could an attacker exploit mistakes in this code?
No issues of this kind were found.
- High
- 0
- Medium
- 0
- Low
- 0
Sources: Bandit, Semgrep, pip-audit
Does this code look like it is trying to cause harm?
No issues of this kind were found.
- High
- 2
- Medium
- 0
- Low
- 0
Sources: YARA, ClamAV, GuardDog, dependency checker
- Likely real
- 0
- Uncertain
- 0
- Likely noise
- 2
The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.
What we found, in plain English
All 2 findings look like noise (low confidence) — nothing here likely needs attention.
Detections by engine
Findings
Highest severity first. Select a finding to see the code and what it means.
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Makefile
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /rfc/20251105-use-cobra-instead-of-mitchellh.md
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
No findings match these filters.