Scan report

superplanehq / superplane

View on GitHub (opens in a new tab)
Go
7553 stars
Scanned 24 Sep 2026, 08:30

Report Rescan

Vulnerability Safe

Could an attacker exploit mistakes in this code?

0 risk score

No issues of this kind were found.

High: 0
Medium: 0
Low: 0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Medium

Does this code look like it is trying to cause harm?

35 risk score

Real issues worth reviewing before you rely on this code.

High: 15
Medium: 4
Low: 5

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

24 total findings

Likely real: 9
Uncertain: 0
Likely noise: 15

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

The repository has a very low vulnerability score of 0, meaning there are no obvious code errors that an attacker could easily exploit right now. However, the scan also found a medium risk score of 35, which indicates that the code contains patterns suggesting it might be intentionally malicious rather than just accidentally insecure. The most concerning findings involve downloading and executing files from remote sources, using suspicious domains for communication, and running hidden scripts or obfuscated payloads that could compromise the system. While some of these issues appear to be standard security practices like reading environment variables or checking file permissions, others stand out as highly suspicious because they combine dangerous actions with specific indicators of intent. The developer should treat this codebase with caution until the malicious patterns are removed and replaced with safe alternatives.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

YARA 15

Malware signature rules · Malicious pattern
GuardDog 9

Supply-chain attack heuristics · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/web_src/src/lib/cli.ts line 1

Likely real
Yes, 95% confidence

Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec]
```
export const CLI_INSTALL_COMMAND = "curl -fsSL https://install.superplane.com/install.sh | sh";

export function getInstallCommand(): string {
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/web_src/src/components/AgentSidebar/widgets/RichMessage.stories.tsx line 94

Likely real
Yes, 95% confidence

Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec]
```
\`\`\`bash
curl -fsSL https://install.superplane.com/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
superplane connect https://app.superplane.com your-token-here
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/pkg/integrations/telegram/client.go line 13

Likely real
Yes, 98% confidence

Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration]
```
const telegramAPIBase = "https://api.telegram.org/bot"

type Client struct {
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/pkg/integrations/telegram/client.go line 13

Likely real
Yes, 97% confidence

Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links]
```
const telegramAPIBase = "https://api.telegram.org/bot"

type Client struct {
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/pkg/integrations/daytona/sandbox_secrets.go line 65

Likely real
Yes, 96% confidence

Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]
```
Required:             false,
							Placeholder:          "/home/daytona/.ssh/id_rsa",
							VisibilityConditions: []configuration.VisibilityCondition{{Field: "type", Values: []string{SandboxSecretTypeF...
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/release/superplane-cli-npm/package.json line 9

Likely real
Yes, 87% confidence

Detects LOLBAS usage in install hooks (execution and network tools) [threat-process-hooks]
```
"scripts": {
    "postinstall": "node install.js"
  },
  "files": [
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/pkg/billing/polar/webhook.go line 102

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
func WebhookSecret() string {
	return strings.TrimSpace(os.Getenv("POLAR_WEBHOOK_SECRET"))
}
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/pkg/billing/polar/client.go line 100

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
func NewClientFromEnv() *Client {
	return NewClient(APIBaseURL(), os.Getenv("POLAR_ACCESS_TOKEN"), nil)
}
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/pkg/billing/polar/client.go line 88

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
func Configured() bool {
	return strings.TrimSpace(os.Getenv("POLAR_ACCESS_TOKEN")) != ""
}
```