Scan report
DataDog / datadog-agent
Could an attacker exploit mistakes in this code?
Serious issues. Review the high-severity findings before using it.
- High
- 13
- Medium
- 99
- Low
- 307
Sources: Bandit, Semgrep, pip-audit
Does this code look like it is trying to cause harm?
Strong warning signs. Do not run or install this without a careful review.
- High
- 46
- Medium
- 4
- Low
- 41
Sources: YARA, ClamAV, GuardDog, dependency checker
- Likely real
- 93
- Uncertain
- 24
- Likely noise
- 393
The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.
What we found, in plain English
The repository DataDog/datadog-agent has been flagged as extremely dangerous, with a critical malicious-pattern score of 104.0 and a high vulnerability risk score of 227.0. These scores indicate that the code contains intentional signs of malicious intent rather than just ordinary insecure coding practices. The most serious issues involve suspicious autostart mechanisms that could persist on the system after the application is removed, destructive file operations like recursive deletion, and download-and-execute patterns that fetch remote files to run them immediately. While some findings relate to potential credential harvesting or access to sensitive configuration files, the sheer volume of these dangerous behaviors suggests the codebase poses a significant threat if used in production environments.
Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.
Detections by engine
Score over time
Overall score each time this repository was scanned.
Findings
Highest severity first. Select a finding to see the code and what it means.
Large result: showing the top 291 of 510 findings (up to 200 per engine, most severe and most likely real first). Totals above include everything.
-
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /tasks/agent.py line 605
- Likely real
- Yes, 99% confidence
Detects suspicious autostart persistence mechanisms [threat-filesystem-autostart]
with tempfile.NamedTemporaryFile(mode='w') as dockerfile: dockerfile.write( f'''FROM ubuntu:latest AS src -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /tasks/kernel_matrix_testing/compiler.py line 282
- Likely real
- Yes, 99% confidence
Detects suspicious autostart persistence mechanisms [threat-filesystem-autostart]
self.exec( f"cp /root/.bashrc /home/{self.compiler_user}/.bashrc && chown {self.host_uid}:{self.host_gid} /home/{self.compiler_user}/.bashrc", user="root", ) -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /tasks/kernel_matrix_testing/compiler.py line 288
- Likely real
- Yes, 98% confidence
Detects suspicious autostart persistence mechanisms [threat-filesystem-autostart]
self.exec( f"echo export DD_CC=/opt/toolchains/{self.arch.gcc_arch}/bin/{self.arch.gcc_arch}-linux-gnu-gcc >> /home/{self.compiler_user}/.bashrc", user=self.compiler_user, ) -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /tasks/omnibus.py line 726
- Likely real
- Yes, 98% confidence
Detects destructive operations (recursive deletion, wiping) [threat-filesystem-destruction]
'mkdir -p /omnibus-state/opt/datadog-agent && ' 'rm -rf /opt/datadog-agent && ' 'ln -sfn /omnibus-state/opt/datadog-agent /opt/datadog-agent && ' 'dda inv -- -e omnibus.build --base-dir=/omnibus --gem-path=/gems' -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /tasks/agent.py line 374
- Likely real
- Yes, 96% confidence
Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec]
@task def exec( ctx, subcommand, -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /tasks/agent.py line 484
- Likely real
- Yes, 95% confidence
Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec]
latest_release = semver.VersionInfo(0) tags = requests.get("https://registry.datadoghq.com/v2/agent/tags/list", timeout=10) for tag in tags.json()['tags']: if not semver.VersionInfo.isvalid(tag): -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /tasks/renovate.py line 533
- Likely real
- Yes, 95% confidence
Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec]
try: with urllib.request.urlopen(url, timeout=120) as resp: # noqa: S310 — URLs come from the source file we're checking hasher = hashlib.sha256() while chunk := resp.read(1 << 20): -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/coverage.py line 331
- Likely real
- Yes, 67% confidence
tarfile.extractall used without any validation. Please check and discard dangerous members.
330 with tarfile.open(f"{downloaded_archive}", "r:gz") as tgz: 331 tgz.extractall(path='.') 332 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kmt.py line 2518
- Likely real
- Yes, 66% confidence
tarfile.extractall used without any validation. Please check and discard dangerous members.
2517 job_folder.mkdir(parents=True, exist_ok=True) 2518 tar.extractall(dest_path / job_folder) 2519 time_msg += f", extracted in {time.time() - download_end_time} seconds" -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/junit_upload_core.py line 92
- Likely real
- Yes, 66% confidence
tarfile.extractall used without any validation. Please check and discard dangerous members.
91 with tarfile.open(junit_tgz) as tgz: 92 tgz.extractall(path=str(working_dir)) 93 # If archive contains folders, save them as we will put split xmls in folder on the working_dir -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/debugging/delve.py line 16
- Likely real
- Uncertain, 35% confidence
Starting a process with a shell, possible injection detected, security issue.
15 def __interactive_cmd(self, cmd): 16 os.system(f'{self.dlv_cmd} {cmd}') 17 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/debugging/dump.py line 338
- Likely real
- Uncertain, 35% confidence
Starting a process with a shell, possible injection detected, security issue.
337 with tempfile.TemporaryDirectory() as tmp_dir: 338 os.system(f'dpkg-deb --raw-extract {deb_path} {tmp_dir}') 339 # example: opt/datadog-agent/.debug/opt/datadog-agent/bin/agent/agent.dbg -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/debugging/dump.py line 375
- Likely real
- Uncertain, 35% confidence
Starting a process with a shell, possible injection detected, security issue.
374 debug_root = 'opt/datadog-agent/.debug' 375 os.system(f'rpm2cpio {rpm_path} | cpio -idm -D {tmp_dir}') 376 shutil.copytree(f"{tmp_dir}/{debug_root}", output_dir, dirs_exist_ok=True) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/debugging/windbg.py line 15
- Likely real
- Uncertain, 35% confidence
Starting a process with a shell, possible injection detected, security issue.
14 def open_dump(self, path: Path | str): 15 os.system(f'cmd.exe /c start {self.windbg_cmd} -z "{path}"') -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/go_mod_formatter_tests.py line 27
- Likely real
- Uncertain, 33% confidence
subprocess call with shell=True identified, security issue.
26 ) 27 p = subprocess.run(f"cp {src} {dest}", shell=True) 28 assert p.returncode == 0 -
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/unit_tests/omnibus_tests.py
- Likely real
- Uncertain, 33% confidence
YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/libs/ciproviders/github_api.py
- Likely real
- Uncertain, 33% confidence
YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/libs/common/omnibus.py
- Likely real
- Uncertain, 33% confidence
YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md
-
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/go_mod_formatter_tests.py line 15
- Likely real
- Uncertain, 32% confidence
subprocess call with shell=True identified, security issue.
14 f"go run ./internal/tools/modformatter/modformatter.go --path {path} --repoPath {repo_path} {extraArgs}", 15 shell=True, 16 capture_output=True, 17 ) 18 if not allow_fail: 19 assert proc.returncode == 0, f"\n{proc.stderr.decode('utf-8')}" 20 return proc.stdout -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/types/types.py line 25
- Likely real
- Uncertain, 32% confidence
subprocess call with shell=True identified, security issue.
24 [f"grep -Rl --include=\"*_test.go\" '{self.name}' '{self.package}'"], 25 shell=True, 26 stdout=subprocess.PIPE, 27 ) 28 return output.stdout.decode('utf-8').splitlines()[0] 29 except Exception as e: 30 print(f"Exception '{e}' while finding test {self.name} from package {self.package}.") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/go.py line 60
- Likely real
- Uncertain, 32% confidence
subprocess call with shell=True identified, security issue.
59 for attempt in range(max_retry): 60 result = subprocess.run(cmd, shell=True, cwd=path, capture_output=True, text=True) 61 if result.returncode == 0: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/static_quality_gates/experimental_gates.py line 863
- Likely real
- Uncertain, 32% confidence
subprocess call with shell=True identified, security issue.
862 ) 863 extract_result = subprocess.run(extract_command, shell=True, capture_output=True).returncode 864 if extract_result != 0: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/system_probe.py line 479
- Likely real
- Uncertain, 32% confidence
subprocess call with shell=True identified, security issue.
478 479 target_packages = [p.strip() for p in check_output(cmd, shell=True, encoding='utf-8').split("\n")] 480 return [p for p in target_packages if len(p) > 0] -
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /pkg/gpu/cuda/testutil/testdata/sample
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /pkg/security/utils/proc_linux.go
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /pkg/fleet/installer/packages/datadog_agent_linux.go
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /pkg/gpu/cuda/testutil/testdata/heavy-sample
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/agent.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /.gitlab/.pre/deps_build/deps_build.yml
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /.gitlab/.pre/deps_fetch/deps_fetch.yml
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/bpftool_downloader.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/renovate.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/omnibus.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/collector.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/install_tasks.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/gotest.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/unit_tests/bazel_remote_cache_tests.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/kernel_matrix_testing/setup/common.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/e2e_framework/setup/pulumi.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/kmt.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Dockerfiles/agent/Dockerfile
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /comp/core/gui/impl/views/private/js/jquery-3.5.1.min.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /comp/core/gui/impl/views/private/js/codemirror.min.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /pkg/template/html/html.go
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /pkg/template/html/escape.go
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /omnibus/package-scripts/agent-dmg/postinst
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /omnibus/package-scripts/dogstatsd-rpm/posttrans
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /omnibus/package-scripts/iot-agent-rpm/posttrans
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /omnibus/package-scripts/iot-agent-deb/postinst
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /omnibus/package-scripts/agent-dmg/preinst
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/kernel_matrix_testing/setup/linux_localvms.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/kernel_matrix_testing/compiler.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /omnibus/package-scripts/dogstatsd-deb/postinst
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/agent.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /q_branch/gadget-k8s-host.lima.yaml
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /comp/core/gui/impl/systray/Sources/gui.swift
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cmd/agent/macos/uninstall_mac_os.sh
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cmd/agent/macos/install_mac_os_v1.sh
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/unit_tests/gitlab_api_tests.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /pkg/ebpf/uprobes/telemetry.go line 41
- Likely real
- Yes, 98% confidence
Detects unicode homoglyphs and uncommon characters used for obfuscation [threat-runtime-obfuscation-unicode]
td.binaryInspectionBuckets = []float64{ 10e3, // 10μs 100e3, // 100μs 1e6, // 1ms -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /pkg/util/cloudproviders/alibaba/alibaba.go line 23
- Likely real
- Yes, 98% confidence
Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration]
var ( metadataURL = "http://100.100.100.200" timeout = 300 * time.Millisecond -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/go_deps.py line 542
- Likely real
- Yes, 98% confidence
Use of insecure and deprecated function (mktemp).
541 542 tmpfile = tempfile.mktemp(prefix="graph-") 543 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/package/url.py line 61
- Likely real
- Yes, 98% confidence
Use of insecure and deprecated function (mktemp).
60 61 filename = tempfile.mktemp() 62 primary_url = f"{packages_url}/{location.get('href')}" -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/e2e_framework/config.py line 166
- Likely real
- Yes, 98% confidence
Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load().
165 content = f.read() 166 config_dict = yaml.load(content, Loader=yaml.Loader) 167 return Config.model_validate(config_dict) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /bazel/rules/macos/pkg/build_mac_pkg.py line 31
- Likely real
- Yes, 97% confidence
Chmod setting a permissive mask 0o755 on file (dst).
30 shutil.copyfile(src, dst) 31 os.chmod(dst, 0o755) 32 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/bpftool_downloader.py line 143
- Likely real
- Yes, 97% confidence
Chmod setting a permissive mask 0o755 on file (bpftool_path).
142 # Make executable 143 os.chmod(bpftool_path, 0o755) 144 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/security_agent.py line 323
- Likely real
- Yes, 97% confidence
Chmod setting a permissive mask 0o755 on file (dst).
322 shutil.copy2(src, dst) 323 os.chmod(dst, 0o755) 324 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/package/url.py line 52
- Likely real
- Yes, 97% confidence
Call to requests with timeout set to None
51 repomd_url = f"{packages_url}/repodata/repomd.xml" 52 response = requests.get(repomd_url, timeout=None) 53 response.raise_for_status() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/system_probe.py line 1077
- Likely real
- Yes, 97% confidence
Chmod setting a permissive mask 0o755 on file (dst).
1076 shutil.copy2(src_bin, dst) 1077 os.chmod(dst, 0o755) 1078 else: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/system_probe.py line 1075
- Likely real
- Yes, 97% confidence
Chmod setting a permissive mask 0o755 on file (dst).
1074 if os.path.exists(dst): 1075 os.chmod(dst, 0o755) 1076 shutil.copy2(src_bin, dst) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/package/url.py line 92
- Likely real
- Yes, 97% confidence
Call to requests with timeout set to None
91 def _deb_get_filename_for_package(packages_url: str, target_package_name: str) -> str: 92 response = requests.get(packages_url, timeout=None) 93 response.raise_for_status() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/download.py line 11
- Likely real
- Yes, 97% confidence
Call to requests with timeout set to None
10 print(f"Downloading {url} to {path}") 11 response = requests.get(url, stream=True, timeout=None) 12 response.raise_for_status() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/build/bazel.py line 276
- Likely real
- Yes, 97% confidence
Chmod setting a permissive mask 0o755 on file (bin_path).
275 shutil.copy2(src, bin_path) 276 os.chmod(bin_path, 0o755) 277 uid = os.environ.get("HOST_UID", "-1") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/gpu.py line 74
- Likely real
- Yes, 97% confidence
Call to requests with timeout set to None
73 try: 74 response = requests.get( 75 artifact_url, 76 headers={"Authorization": token}, 77 stream=True, 78 timeout=None, 79 ) 80 response.raise_for_status() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/coverage.py line 66
- Likely real
- Yes, 97% confidence
Chmod setting a permissive mask 0o755 on file (call_ps1_from_bat).
65 os.chmod(self.cov_test_path, 0o755) 66 os.chmod(self.call_ps1_from_bat, 0o755) 67 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/coverage.py line 65
- Likely real
- Yes, 97% confidence
Chmod setting a permissive mask 0o755 on file (cov_test_path).
64 65 os.chmod(self.cov_test_path, 0o755) 66 os.chmod(self.call_ps1_from_bat, 0o755) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/collector.py line 205
- Likely real
- Yes, 97% confidence
Chmod setting a permissive mask 0o755 on file (binary_path).
204 urllib.request.urlretrieve(binary_url, binary_path) 205 os.chmod(binary_path, 0o755) 206 print(f"Downloaded to {binary_path}") -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cmd/cluster-agent/subcommands/start/command.go line 488
- Likely real
- Yes, 96% confidence
Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]
} if env := config.GetString("cluster_agent.tracing.env"); env != "" { opts = append(opts, tracer.WithEnv(env)) } -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cmd/security-agent/subcommands/start/command.go line 408
- Likely real
- Yes, 96% confidence
Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]
ProfilingURL: site, Env: config.GetString(secAgentKey("internal_profiling.env")), Service: "security-agent", Period: config.GetDuration(secAgentKey("internal_profiling.period")), -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/bazel.py line 176
- Likely real
- Yes, 56% confidence
Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
175 return 176 tree = ET.parse(xml_path) 177 root = tree.getroot() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/bazel.py line 216
- Likely real
- Yes, 56% confidence
Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
215 try: 216 file_root = ET.parse(xml_path).getroot() 217 except ET.ParseError: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/ci.py line 198
- Likely real
- Yes, 56% confidence
Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
197 if data is not None: 198 reports.append(ET.parse(data)) 199 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kmt.py line 2148
- Likely real
- Yes, 56% confidence
Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
2147 for file in vm_folder.glob("*.xml"): 2148 xml = ET.parse(file) 2149 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/junit_upload_core.py line 49
- Likely real
- Yes, 56% confidence
Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
48 """ 49 tree = ET.parse(xml_path) 50 root = tree.getroot() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/junit_upload_core.py line 161
- Likely real
- Yes, 56% confidence
Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
160 """ 161 tree = ET.parse(xml_path) 162 output_xmls = {} -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/package/url.py line 54
- Likely real
- Yes, 52% confidence
Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
53 response.raise_for_status() 54 repomd = ET.fromstring(response.text) 55 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/package/url.py line 67
- Likely real
- Yes, 52% confidence
Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
66 67 primary = ET.fromstring(res.stdout.strip()) 68 for package in primary.findall('.//{*}package'): -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/bazel_tests.py line 78
- Likely real
- Yes, 52% confidence
Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
77 def test_true_when_every_testcase_has_classname(self): 78 suite = ET.fromstring( 79 '<testsuite tests="2">' 80 '<testcase name="TestFoo" classname="pkg/foo"></testcase>' 81 '<testcase name="TestBar" classname="pkg/foo"></testcase>' 82 "</testsuite>" 83 ) 84 self.assertTrue(_is_gotestsum_shaped(suite)) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/bazel_tests.py line 89
- Likely real
- Yes, 52% confidence
Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
88 # (diff_test, sh_test, rust tests, ...): one testcase, no classname. 89 suite = ET.fromstring('<testsuite tests="1"><testcase name="some_check" status="run"></testcase></testsuite>') 90 self.assertFalse(_is_gotestsum_shaped(suite)) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/python_version.py line 147
- Likely real
- Uncertain, 49% confidence
Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
146 req = urllib.request.Request(url) 147 with urllib.request.urlopen(req, timeout=timeout, context=ctx) as response: 148 return response.read().decode('utf-8') -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/renovate.py line 533
- Likely real
- Uncertain, 49% confidence
Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
532 try: 533 with urllib.request.urlopen(url, timeout=120) as resp: # noqa: S310 — URLs come from the source file we're checking 534 hasher = hashlib.sha256() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/collector.py line 204
- Likely real
- Uncertain, 49% confidence
Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
203 try: 204 urllib.request.urlretrieve(binary_url, binary_path) 205 os.chmod(binary_path, 0o755) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/bpftool_downloader.py line 66
- Likely real
- Uncertain, 48% confidence
Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
65 try: 66 urllib.request.urlretrieve(url, dest) 67 return True -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /deps/cacerts/update_cacerts.py line 29
- Likely real
- Uncertain, 48% confidence
Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
28 def _fetch(url): 29 with urllib.request.urlopen(url) as resp: 30 return resp.read().decode("utf-8") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/omnibus.py line 214
- Likely real
- Uncertain, 48% confidence
Use of weak SHA1 hash for security. Consider usedforsecurity=False
213 print('Computing cache key') 214 h = hashlib.sha1() 215 _hash_paths( -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/renovate.py line 85
- Likely real
- Uncertain, 41% confidence
Use of possibly insecure function - consider using safer ast.literal_eval.
84 try: 85 namespace[name] = eval(expr, {"__builtins__": {}}, namespace) # noqa: S307 — restricted namespace, preamble-only expressions 86 except Exception: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/renovate.py line 476
- Likely real
- Uncertain, 41% confidence
Use of possibly insecure function - consider using safer ast.literal_eval.
475 try: 476 result = eval(expr, {"__builtins__": {}}, namespace) # noqa: S307 — namespace is preamble-only scalars 477 except Exception: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /bazel/rules/go/gen_tags_go.py line 27
- Likely real
- Uncertain, 40% confidence
Use of exec detected.
26 with open(bzl_path) as src: 27 exec(src.read(), namespace) # noqa: S102 - build_tags.bzl is trusted, valid Python 28 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/vmconfig.py line 802
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
801 802 tmpfile = "/tmp/vm.json" 803 with open(tmpfile, "w") as f: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/notify/failure_summary_tests.py line 16
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
15 16 TEST_DIR = '/tmp/summary' 17 ALL_TEAMS_CHANNEL = '#channel-broadcast' -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/common/worktree_tests.py line 13
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
12 13 TEST_WORKTREE_DIR = Path('/tmp/datadog-agent-worktree') 14 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/custom_task/custom_task.py line 23
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
22 WIN_TEMP_FOLDER = "C:\\Windows\\Temp" 23 UNIX_TEMP_FOLDER = "/tmp" 24 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 501
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
500 build: bool = True, 501 main_report_path: str = "/tmp/observer-eval-main-report.json", 502 config: str = "", 503 scenario_output_dir: str = "/tmp", 504 timeout: int = 0, 505 scenarios: str = "", 506 _logger: StepLogger | None = None, 507 ) -> dict: 508 """ 509 Runs the observer F1 eval: replays scenarios, scores Gaussian F1. 510 511 The main score is a metric between 0 and 1, 1 being the best. This is the 512 source of truth for anomaly detection accuracy. 513 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/bpftool_downloader.py line 87
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
86 87 def download_bpftool(install_dir: str = "/tmp") -> Optional[str]: 88 """ -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /omnibus/python-scripts/packages_tests.py line 103
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
102 with patch('packages.run_command', return_value=('', '', 0)) as mock_cmd: 103 install_datadog_package('datadog-ping==1.0.2', '/tmp/agent') 104 mock_cmd.assert_called_once() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /omnibus/python-scripts/packages_tests.py line 110
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
109 with patch('packages.run_command', side_effect=[('', 'err', 1), ('', '', 0)]) as mock_cmd: 110 install_datadog_package('datadog-ping==1.0.2', '/tmp/agent') 111 self.assertEqual(mock_cmd.call_count, 2) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/e2e_framework/test.py line 53
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
52 "nvram": "/tmp/nvram", 53 "efi": "/tmp/efi", 54 "vcpu": "4", 55 "cputune": "<cputune></cputune>", 56 "hypervisor": "hvf", 57 "commandLine": "<arg value=\"test\"/>", 58 } 59 60 for repl in replacements or []: 61 key, value = repl.split("=") 62 default_replacements[key] = value 63 64 with open(xslt) as f: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/anomalydetection_ddeval_tests.py line 41
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
40 with self.assertRaisesRegex(Exit, "custom --testbench-binary requires --no-build"): 41 eval_ddeval.body(None, testbench_binary="/tmp/custom-testbench") 42 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/package/size.py line 71
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
70 def extract_rpm_package(ctx, package_path, extract_dir): 71 log_dir = os.environ.get("CI_PROJECT_DIR", "/tmp") 72 out = ctx.run( -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/notify/failure_summary.py line 32
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
31 FAILURE_SUMMARY_S3_BUCKET_URL = f"s3://{FAILURE_SUMMARY_S3_BUCKET}/{FAILURE_SUMMARY_S3_PREFIX}" 32 FAILURE_SUMMARY_TMP_FILE = "/tmp/failure_summary.json" 33 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kmt.py line 2047
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
2046 boot_log_savepath = ( 2047 Path("/tmp") 2048 / f"kmt-pipeline-{pipeline}" -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kmt.py line 1392
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
1391 tmp.flush() 1392 remote_tmp = "/tmp" 1393 remote_run_config = os.path.join(remote_tmp, os.path.basename(tmp.name)) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kmt.py line 388
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
387 for domain in infra[arch].microvms: 388 domain.copy(ctx, provision_script, "/tmp/provision.sh") 389 domain.run_cmd(ctx, "chmod +x /tmp/provision.sh && /tmp/provision.sh", verbose=True) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/infra.py line 33
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
32 "ControlPersist": "10m", 33 "ControlPath": "/tmp/ssh_mux_%h_%p_%r", 34 } 35 36 37 def ssh_options_command(extra_opts: dict[str, str] | None = None): 38 opts = SSH_OPTIONS.copy() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/gdb.py line 46
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
45 self.target.copy( 46 ctx, get_repo_root() / "tasks/kernel_matrix_testing/provision/ubuntu-dbg.sh", "/tmp/provision.sh" 47 ) 48 self.target.run_cmd(ctx, "chmod +x /tmp/provision.sh && /tmp/provision.sh") 49 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/compiler.py line 25
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
24 CONTAINER_AGENT_PATH = "/tmp/datadog-agent" 25 MARKER_IMAGE_PREPARED = "/tmp/kmt-image-prepared" 26 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/compiler.py line 24
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
23 24 CONTAINER_AGENT_PATH = "/tmp/datadog-agent" 25 MARKER_IMAGE_PREPARED = "/tmp/kmt-image-prepared" -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/ebpf.py line 775
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
774 common_ancestor = get_common_ancestor(ctx, commit_sha, base_branch_ref) 775 main_branch_complexity_path = Path("/tmp/verifier-complexity-main") 776 print(f"Downloading complexity data for {base_branch} branch (commit {common_ancestor})...") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/ai_sandbox.py line 64
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
63 stack_name="ai-sandbox", 64 remote_output_dir="/tmp/ai-sandbox-output", 65 local_output_dir="./ai-sandbox-output", 66 keep=False, 67 ): 68 """ 69 Provision an AWS host (agent installed), run claude/codex on it, and retrieve a directory. 70 71 Example: 72 dda inv ai-sandbox.run --tool=claude --model=claude-opus-4-8 \\ 73 --prompt="Summarize the agent status into /tmp/ai-sandbox-output/summary.txt" \\ 74 --remote-output-dir=/tmp/ai-sandbox-output --local-output-dir=./out 75 """ 76 if tool not in ("claude", "codex"): 77 raise Exit(message=f"unknown --tool {tool!r} (expected claude or codex)", code=1) 78 if not prompt and not prompt_file: 79 raise Exit(message="one of --prompt or --prompt-file is required", code=1) 80 if prompt and prompt_file: 81 raise Exit(message="--prompt and --prompt-file are mutually exclusive", code=1) 82 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/e2e_framework/test.py line 52
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
51 "mac": "52:54:00:00:00:00", 52 "nvram": "/tmp/nvram", 53 "efi": "/tmp/efi", 54 "vcpu": "4", 55 "cputune": "<cputune></cputune>", 56 "hypervisor": "hvf", 57 "commandLine": "<arg value=\"test\"/>", 58 } 59 60 for repl in replacements or []: 61 key, value = repl.split("=") 62 default_replacements[key] = value 63 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 2608
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
2607 workspace_name: str, 2608 output_dir: str = "/tmp/observer-pipeline-eval", 2609 local_dir: str = "", 2610 only_report: bool = False, 2611 ): 2612 """ 2613 After ``anomalydetection.eval-pipeline`` on a remote dev workspace, copy results to your machine. -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 2544
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
2543 workspace_name: str, 2544 output_dir: str = "/tmp/observer-component-eval", 2545 local_dir: str = "", 2546 only_report: bool = False, 2547 ): 2548 """ 2549 After ``anomalydetection.eval-component`` on a remote dev workspace, copy results to your machine. -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 2242
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
2241 m_runs: int = 1, 2242 output_dir: str = "/tmp/observer-component-eval", 2243 scenarios_dir: str = "./comp/anomalydetection/observer/scenarios", 2244 sigma: float = 30.0, 2245 seed: int = None, 2246 build: bool = True, 2247 overwrite: bool = False, 2248 tune_evaluated_component: bool = False, 2249 enable: str = "", 2250 disable: str = "", 2251 lock: str = "", 2252 timeout: int = 300, 2253 scenarios: str = "", 2254 ): 2255 """ 2256 Evaluate whether adding a component improves observer accuracy via Bayesian optimization. 2257 2258 For N random subsets of detectors/correlators: 2259 - Run M independent Bayesian optimizations WITHOUT the target component. -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 1870
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
1869 m_runs: int = 1, 1870 output_dir: str = "/tmp/observer-pipeline-eval", 1871 scenarios_dir: str = "./comp/anomalydetection/observer/scenarios", 1872 sigma: float = 30.0, 1873 seed: int = None, 1874 build: bool = True, 1875 overwrite: bool = False, 1876 resume: bool = False, 1877 force_enable: str = "", 1878 force_disable: str = "", 1879 timeout: int = 0, 1880 scenarios: str = "", 1881 eval_backend: str = "local", 1882 ddeval_config_template: str = "", 1883 ddeval_ddsource_dir: str = "", 1884 ddeval_command: str = "", 1885 ddeval_service: str = "eval_worker_observer_log_ad", 1886 ddeval_project: str = "observer-log-ad", 1887 ddeval_dataset: str = "observer-log-ad-gensim-store-working", 1888 ddeval_env: str = "staging", 1889 ddeval_test_drive: str = "observer-log-ad-ddeval-worker", 1890 ddeval_jobs: int = 6, 1891 ddeval_max_attempts: int = 1, 1892 ddeval_limit: int = 0, 1893 ddeval_where_in: str = "", 1894 ddeval_testbench_binary_s3_uri: str = "", 1895 ddeval_scorer_binary_s3_uri: str = "", 1896 ): 1897 """ 1898 Full pipeline fine-tuning: Bayesian search over component combinations, then deep tuning on the winner. 1899 1900 Step 1 — Search: for each of n_combos combinations (full stack + anchor subsets + random), 1901 run Bayesian HP optimisation with n_trials_search trials. The combination with the -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 1180
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
1179 n_trials: int = 10, 1180 output_dir: str = "/tmp/observer-optuna-eval", 1181 scenarios_dir: str = "./comp/anomalydetection/observer/scenarios", 1182 sigma: float = 30.0, 1183 seed: int = None, 1184 build: bool = True, 1185 overwrite: bool = False, 1186 timeout: int = 0, 1187 scenarios: str = "", 1188 eval_backend: str = "local", 1189 ddeval_config_template: str = "", 1190 ddeval_ddsource_dir: str = "", 1191 ddeval_command: str = "", 1192 ddeval_service: str = "eval_worker_observer_log_ad", 1193 ddeval_project: str = "observer-log-ad", 1194 ddeval_dataset: str = "observer-log-ad-gensim-store-working", 1195 ddeval_env: str = "staging", 1196 ddeval_test_drive: str = "observer-log-ad-ddeval-worker", 1197 ddeval_jobs: int = 6, 1198 ddeval_max_attempts: int = 1, 1199 ddeval_limit: int = 0, 1200 ddeval_where_in: str = "", 1201 ddeval_testbench_binary_s3_uri: str = "", 1202 ddeval_scorer_binary_s3_uri: str = "", 1203 _logger: StepLogger | None = None, 1204 ): 1205 """ 1206 Run Bayesian hyperparameter optimization (Optuna TPE) for a fixed set of observer components. 1207 1208 Each trial enables the specified components, sampling hyperparameters and scoring via 1209 eval_scenarios (mean F1). Locked components (--lock) are enabled but use Go defaults (not tuned). -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 799
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
798 n: int = 10, 799 output_dir: str = "/tmp/observer-eval-combinations", 800 scenarios_dir: str = "./comp/anomalydetection/observer/scenarios", 801 sigma: float = 30.0, 802 seed: int = None, 803 build: bool = True, 804 overwrite: bool = False, 805 force_enable: str = "", 806 force_disable: str = "", 807 ): 808 """ 809 Run Gaussian F1 eval on n component combinations and rank them. -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 711
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
710 711 output_path = f"/tmp/observer-eval-{name}-tp.json" 712 print(color_message(f"\n{'=' * 60}", Color.BLUE)) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 503
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
502 config: str = "", 503 scenario_output_dir: str = "/tmp", 504 timeout: int = 0, 505 scenarios: str = "", 506 _logger: StepLogger | None = None, 507 ) -> dict: 508 """ 509 Runs the observer F1 eval: replays scenarios, scores Gaussian F1. 510 511 The main score is a metric between 0 and 1, 1 being the best. This is the 512 source of truth for anomaly detection accuracy. 513 514 Uses testbench --only to control which components are active. 515 Default (no --only): uses testbench defaults (bocpd, rrcf, and -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 188
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
187 if not cpu_profile_path: 188 cpu_profile_path = f"/tmp/anomalydetection-testbench-headless-{headless_scenario}.cpu.prof" 189 flags += f" --cpuprofile {shlex.quote(cpu_profile_path)}" -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/anomalydetection_eval_tests.py line 110
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
109 self.evaluation_inputs = _bayesian_evaluation_inputs( 110 scenarios_dir="/tmp/scenarios", 111 sigma=30.0, -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /omnibus/python-scripts/packages_tests.py line 118
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
117 with self.assertRaises(IntegrationInstallError) as ctx: 118 install_datadog_package('datadog-ping==1.0.2', '/tmp/agent') 119 self.assertEqual(mock_cmd.call_count, 2) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 181
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
180 if not headless_output: 181 headless_output = f"/tmp/anomalydetection-testbench-headless-{headless_scenario}.json" 182 if mem_profile: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 184
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
183 if not mem_profile_path: 184 mem_profile_path = f"/tmp/anomalydetection-testbench-headless-{headless_scenario}.mem.prof" 185 flags += f" --memprofile {shlex.quote(mem_profile_path)}" -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/url_tests.py line 225
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
224 # Mock tempfile.mktemp 225 mock_mktemp.return_value = "/tmp/fake_temp_file" 226 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/url_tests.py line 90
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
89 # Mock tempfile.mktemp 90 mock_mktemp.return_value = "/tmp/fake_temp_file" 91 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/url_tests.py line 24
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
23 # Mock tempfile.mktemp 24 mock_mktemp.return_value = "/tmp/fake_temp_file" 25 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/setup_env_tests.py line 110
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
109 @unittest.skipUnless(os.name == 'posix', "POSIX-only test") 110 @patch('os.path.abspath', return_value='/tmp/agent.msi') 111 def test_unix_path(self, _mock_abspath): -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/setup_env_tests.py line 112
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
111 def test_unix_path(self, _mock_abspath): 112 result = _path_to_file_url('/tmp/agent.msi') 113 self.assertEqual(result, "file:///tmp/agent.msi") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/common/go_tests.py line 94
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
93 94 result = go_build(self.ctx_mock, "main.go", bin_path="/tmp/test_binary") 95 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/common/go_tests.py line 72
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
71 self.assertEqual(result.exited, 0) 72 mock_exists.assert_called_once_with("/tmp/test_binary") 73 mock_chown.assert_not_called() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/common/go_tests.py line 69
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
68 69 result = go_build(self.ctx_mock, "main.go", bin_path="/tmp/test_binary") 70 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/common/go_tests.py line 59
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
58 self.assertEqual(result.exited, 0) 59 mock_exists.assert_called_once_with("/tmp/test_binary") 60 mock_chown.assert_not_called() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/common/go_tests.py line 56
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
55 56 result = go_build(self.ctx_mock, "main.go", bin_path="/tmp/test_binary") 57 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/common/go_tests.py line 47
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
46 mock_exists.assert_called_once_with("/tmp/test_binary") 47 mock_chown.assert_called_once_with("/tmp/test_binary", 1000, 1001) 48 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/common/go_tests.py line 46
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
45 self.assertEqual(result.exited, 0) 46 mock_exists.assert_called_once_with("/tmp/test_binary") 47 mock_chown.assert_called_once_with("/tmp/test_binary", 1000, 1001) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/common/go_tests.py line 43
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
42 43 result = go_build(self.ctx_mock, "main.go", bin_path="/tmp/test_binary") 44 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/e2e_framework_tool_tests.py line 82
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
81 # Empty is a valid passphrase, so presence -- not truthiness -- is what counts. 82 for ambient in ({"PULUMI_CONFIG_PASSPHRASE": ""}, {"PULUMI_CONFIG_PASSPHRASE_FILE": "/tmp/pass"}): 83 with self.subTest(ambient=ambient), mock.patch.dict("os.environ", ambient, clear=True): -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/e2e_framework_tool_tests.py line 47
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
46 ctx = _run_mock() 47 tool.run_pulumi(ctx, "version", project_dir="/tmp/a dir") 48 self.assertEqual(_command(ctx), "pulumi -C '/tmp/a dir' version") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/custom_task/custom_task_tests.py line 106
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
105 log_invoke_task( 106 log_path="/tmp/dd_invoke.log", 107 name="tname", -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/bazel_tests.py line 55
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
54 [ 55 Path("/tmp/test.xml"), 56 Path("/exec/root/bazel-out/k8-fastbuild/testlogs/pkg/foo/bar_test/test.xml"), -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/bazel_tests.py line 30
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
29 paths = _test_output_candidates("//pkg/foo:bar_test", "file:///tmp/test.xml", "cfg1", None, {}, "test.xml") 30 self.assertEqual(paths, [Path("/tmp/test.xml")]) 31 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/anomalydetection_ddeval_tests.py line 165
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
164 dataset_version=6, 165 config_path="/tmp/config.json", 166 jobs=20, -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/release_tests.py line 32
- Likely real
- Probably noise, 24% confidence
Probable insecure usage of temp file/directory.
31 32 MOCK_TMP_DIR = '/tmp/tmp' 33 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/cluster_agent.py line 214
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
213 latest_release = semver.VersionInfo(0) 214 tags = requests.get("https://registry.datadoghq.com/v2/cluster-agent/tags/list") 215 for tag in tags.json()['tags']: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/collector.py line 481
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
480 try: 481 response = requests.get(url) 482 response.raise_for_status() # Raises an HTTPError if the HTTP request returned an unsuccessful status code -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/gotest.py line 1521
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
1520 upstream_pattern = r"^go (1(?:\.\d+){1,2})[\r]?$" 1521 r = requests.get(OTEL_UPSTREAM_GO_MOD_PATH) 1522 upstream_matches = re.findall(upstream_pattern, r.text, flags=re.MULTILINE) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/download.py line 33
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
32 sum_url = os.path.join(url_base, branch, get_sum_file(image)) 33 r = requests.get(sum_url) 34 if not r.ok: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/vmconfig.py line 933
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
932 try: 933 r = requests.get(sum_url) 934 r.raise_for_status() # Raise an exception for bad status codes -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/omnibus.py line 358
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
357 } 358 r = requests.post("https://api.datadoghq.com/api/v1/events", json=payload, headers=headers) 359 if not r.ok: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/utils.py line 711
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
710 try: 711 with requests.get(url, stream=True) as r: 712 r.raise_for_status() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/licenses.py line 211
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
210 try: 211 resp = requests.get(url.geturl()) 212 resp.raise_for_status() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/system_probe.py line 1595
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
1594 # only download images not present in preprepared vm disk 1595 resp = requests.get(u) 1596 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/e2e_framework_tool_tests.py line 78
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'from-config'
77 env = tool.pulumi_env() 78 self.assertEqual(env, {"PULUMI_SKIP_UPDATE_CHECK": "true", "PULUMI_CONFIG_PASSPHRASE": "from-config"}) 79 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/e2e_framework_tool_tests.py line 98
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'explicit'
97 env = tool.pulumi_env( 98 overrides={"PULUMI_CONFIG_PASSPHRASE": "explicit", "PULUMI_K8S_DELETE_UNREACHABLE": "true"} 99 ) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/github_tasks_tests.py line 523
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'coucou'
522 523 @patch.dict('os.environ', {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'coucou'}) 524 @patch('slack_sdk.WebClient', autospec=True) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/github_tasks_tests.py line 567
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'coucou'
566 567 @patch.dict('os.environ', {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'coucou'}) 568 @patch('slack_sdk.WebClient', autospec=True) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/github_tasks_tests.py line 625
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'coucou'
624 625 @patch.dict('os.environ', {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'coucou'}) 626 @patch('slack_sdk.WebClient', autospec=True) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/release_tests.py line 532
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'slock'
531 ) 532 @patch.dict(os.environ, {'GITLAB_CI': 'true', 'GITHUB_ACTIONS': 'true', 'SLACK_DATADOG_AGENT_BOT_TOKEN': 'slock'}) 533 @patch('os.chdir', new=MagicMock()) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/release_tests.py line 717
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'sluck'
716 ) 717 @patch.dict(os.environ, {'GITLAB_CI': 'true', 'GITHUB_ACTIONS': 'true', 'SLACK_DATADOG_AGENT_BOT_TOKEN': 'sluck'}) 718 @patch('os.chdir', new=MagicMock()) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/bazel_remote_cache_tests.py line 122
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'deadbeef'
121 self.assertEqual( 122 self._run(policy="auto", curl=0, vault=False, extra_env={"BUILDBARN_ID_TOKEN": "deadbeef"}), 123 "--config=cache", -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/pipeline_tests.py line 36
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'zidane'
35 self.gh = MagicMock() 36 self.gh._auth.token = "zidane" 37 self.commits = MagicMock() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/github_tasks_tests.py line 479
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'coucou'
478 class TestCheckPermissions(unittest.TestCase): 479 @patch.dict('os.environ', {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'coucou'}) 480 @patch('slack_sdk.WebClient', autospec=True) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/bazel_remote_cache_tests.py line 141
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'deadbeef'
140 container=True, 141 extra_env={"BUILDBARN_ID_TOKEN": "deadbeef"}, 142 ), -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/e2e_framework/tool.py line 186
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'ci.datadog-agent.pulumi_password'
185 CI_PULUMI_BACKEND_URL = "s3://dd-pulumi-state" 186 CI_PULUMI_PASSPHRASE_SSM_PARAM = "ci.datadog-agent.pulumi_password" 187 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/release_tests.py line 599
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'slick'
598 @patch('os.chdir', new=MagicMock()) 599 @patch.dict(os.environ, {'GITLAB_CI': 'false', 'GITHUB_ACTIONS': 'false', 'SLACK_DATADOG_AGENT_BOT_TOKEN': 'slick'}) 600 def test_changes_new_commit_all_repo(self, version_mock, print_mock, _, web_mock): -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/notify/alerts_tests.py line 296
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'coucou'
295 @patch('slack_sdk.WebClient', autospec=True) 296 @patch.dict('os.environ', {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'coucou'}) 297 @patch.object(alerts.ConsecutiveJobAlert, 'message', lambda self, _: '\n'.join(self.failures) + '\n') -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/notify/alerts_tests.py line 232
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'coucou'
231 @patch('slack_sdk.WebClient', autospec=True) 232 @patch.dict('os.environ', {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'coucou'}) 233 @patch.object(alerts.ConsecutiveJobAlert, 'message', lambda self, _: '\n'.join(self.failures) + '\n') -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/devcontainer.py line 172
- Likely real
- Yes, 95% confidence
Possible hardcoded password: '${localEnv:GITLAB_TOKEN}'
171 "GITHUB_TOKEN": "${localEnv:GITHUB_TOKEN}", 172 "GITLAB_TOKEN": "${localEnv:GITLAB_TOKEN}", 173 } 174 175 configure_skaffold(devcontainer, SkaffoldProfile(skaffoldProfile)) 176 configure_claude_code(devcontainer, claude_code) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/devcontainer.py line 171
- Likely real
- Yes, 95% confidence
Possible hardcoded password: '${localEnv:GITHUB_TOKEN}'
170 devcontainer["containerEnv"] = { 171 "GITHUB_TOKEN": "${localEnv:GITHUB_TOKEN}", 172 "GITLAB_TOKEN": "${localEnv:GITLAB_TOKEN}", 173 } 174 175 configure_skaffold(devcontainer, SkaffoldProfile(skaffoldProfile)) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/invoke_unit_tests.py line 14
- Likely real
- Yes, 95% confidence
Possible hardcoded password: '618'
13 'CI_PIPELINE_ID': '42', 14 'CI_JOB_TOKEN': '618', 15 'CI_PROJECT_DIR': '.', 16 } 17 18 19 @task(default=True) 20 def run(ctx, tests: str = '', buffer: bool = True, verbosity: int = 1, debug: bool = True, directory: str = '.'): 21 """ 22 Run the unit tests on the invoke tasks 23 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/stacks.py line 261
- Likely real
- Yes, 95% confidence
Possible hardcoded password: '1234'
260 env = { 261 "PULUMI_CONFIG_PASSPHRASE": "1234", 262 "LibvirtSSHKeyX86": f"{stack_dir}/libvirt_rsa-x86_64", 263 "LibvirtSSHKeyARM": f"{stack_dir}/libvirt_rsa-arm64", 264 "CI_PROJECT_DIR": stack_dir, 265 } 266 267 vm_config = f"{stack_dir}/{VMCONFIG}" -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/stacks.py line 220
- Likely real
- Yes, 95% confidence
Possible hardcoded password: '1234'
219 "TEAM": "ebpf-platform", 220 "PULUMI_CONFIG_PASSPHRASE": "1234", 221 "LibvirtSSHKeyX86": f"{stack_dir}/libvirt_rsa-x86_64", 222 "LibvirtSSHKeyARM": f"{stack_dir}/libvirt_rsa-arm64", 223 "CI_PROJECT_DIR": stack_dir, 224 } 225 226 provision_instance = remote_vms_in_config(vm_config) 227 local = local_vms_in_config(vm_config) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/omnibus.py line 96
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'Used to sign packages'
95 'DEB_GPG_KEY_NAME': 'Used to sign packages', 96 'DEB_SIGNING_PASSPHRASE': 'Used to sign packages', 97 'LD_PRELOAD': 'Needed to fake armv7l architecture (via libfakearmv7l.so, see Dockerfile for rpm_armhf buildimage)', 98 'RPM_GPG_KEY': 'Used to sign packages', 99 'RPM_GPG_KEY_NAME': 'Used to sign packages', 100 'RPM_SIGNING_PASSPHRASE': 'Used to sign packages', 101 }, 102 'darwin': { 103 'AWS_SHARED_CREDENTIALS_FILE': 'Path to the CI Identities-populated AWS credentials file, read by Omnibus for S3 cache access', 104 'APPLE_ACCOUNT': 'Apple developer account used for notarization', 105 'NOTARIZATION_ATTEMPTS': 'Number of retries for notarization steps', -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/omnibus.py line 100
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'Used to sign packages'
99 'RPM_GPG_KEY_NAME': 'Used to sign packages', 100 'RPM_SIGNING_PASSPHRASE': 'Used to sign packages', 101 }, 102 'darwin': { 103 'AWS_SHARED_CREDENTIALS_FILE': 'Path to the CI Identities-populated AWS credentials file, read by Omnibus for S3 cache access', 104 'APPLE_ACCOUNT': 'Apple developer account used for notarization', 105 'NOTARIZATION_ATTEMPTS': 'Number of retries for notarization steps', 106 'NOTARIZATION_PWD': 'App-specific password for notarization', 107 'NOTARIZATION_TIMEOUT': 'Timeout for xcrun notarytool wait', 108 'TEAM_ID': 'Apple developer team ID used for notarization', 109 'KEYCHAIN_NAME': 'Name of the ephemeral keychain holding signing certificates', -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/issue_tests.py line 324
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'fake-token'
323 'os.environ', 324 {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'fake-token'}, 325 ) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/gitlab_api_tests.py line 697
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'fake-token'
696 mock_response = MagicMock(ok=True) 697 mock_response.json.return_value = {'token': 'fake-token'} 698 mock_session = mock_session_cls.return_value -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/issue_tests.py line 20
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'fake-token'
19 'os.environ', 20 {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'fake-token'}, 21 ) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/issue_tests.py line 71
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'fake-token'
70 'os.environ', 71 {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'fake-token'}, 72 ) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/issue_tests.py line 103
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'fake-token'
102 'os.environ', 103 {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'fake-token'}, 104 ) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/issue_tests.py line 134
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'fake-token'
133 'os.environ', 134 {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'fake-token'}, 135 ) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/issue_tests.py line 165
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'fake-token'
164 'os.environ', 165 {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'fake-token'}, 166 ) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/issue_tests.py line 191
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'fake-token'
190 { 191 'SLACK_DATADOG_AGENT_BOT_TOKEN': 'fake-token', 192 }, 193 ) 194 @patch('tasks.issue.GithubAPI') -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/issue_tests.py line 231
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'fake-token'
230 'os.environ', 231 {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'fake-token'}, 232 ) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/issue_tests.py line 277
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'fake-token'
276 'os.environ', 277 {'PR_REQUESTED_TEAMS': '[{"slug": "team1"}]', 'SLACK_DATADOG_AGENT_BOT_TOKEN': 'fake-token'}, 278 ) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/issue_tests.py line 367
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'fake-token'
366 'os.environ', 367 {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'fake-token'}, 368 ) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/gitlab_api_tests.py line 702
- Likely real
- Yes, 93% confidence
Possible hardcoded password: 'legacy-token'
701 702 @patch.dict('os.environ', {'GITLAB_TOKEN': 'legacy-token'}) 703 @patch('tasks.libs.ciproviders.gitlab_api.running_in_ci', return_value=True) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/gitlab_api_tests.py line 738
- Likely real
- Yes, 93% confidence
Possible hardcoded password: 'local-token'
737 738 @patch.dict('os.environ', {'GITLAB_TOKEN': 'local-token'}) 739 @patch('tasks.libs.ciproviders.gitlab_api.running_in_ci', return_value=False) -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cmd/system-probe/subcommands/usm/sysinfo_linux.go line 104
- Likely real
- Yes, 93% confidence
Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info]
// Get hostname hostname, err := os.Hostname() if err != nil { sysInfo.Hostname = fmt.Sprintf("<unable to detect: %v>", err) -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cmd/serverless-init/cloudservice/service.go line 203
- Likely real
- Yes, 93% confidence
Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info]
func GetCloudServiceType() CloudService { arch := runtime.GOARCH if isMicroVM() { -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cmd/serverless-init/cloudservice/service.go line 117
- Likely real
- Yes, 93% confidence
Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info]
func (l *LocalService) GetTags() map[string]string { hostname, err := os.Hostname() if err != nil { log.Warnf("failed to get hostname for local usage metric instance tag: %v", err) -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /.dda/extend/commands/gh/cherry_pick_pr/__init__.py line 154
- Likely real
- Yes, 93% confidence
Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
g = Github(os.getenv("GITHUB_TOKEN")) repo = g.get_repo("DataDog/datadog-agent") pr = repo.get_pull(pr_number) -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /.dda/extend/commands/gh/cherry_pick_pr/__init__.py line 55
- Likely real
- Yes, 93% confidence
Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
# Authenticate to GitHub and get a token token = os.getenv("GITHUB_TOKEN") if not token: app.abort("GITHUB_TOKEN is not set") -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cmd/secret-generic-connector/backend/hashicorp/vault.go line 80
- Likely real
- Yes, 93% confidence
Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
tokenPath := os.Getenv("DD_SECRETS_SA_TOKEN_PATH") if tokenPath == "" { if configPath := sessionConfig.VaultKubernetesJWTPath; configPath != "" { -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/omnibus.py line 110
- Likely real
- Yes, 91% confidence
Possible hardcoded password: 'Password for the ephemeral signing keychain'
109 'KEYCHAIN_NAME': 'Name of the ephemeral keychain holding signing certificates', 110 'KEYCHAIN_PWD': 'Password for the ephemeral signing keychain', 111 }, 112 } 113 114 115 def _get_environment_for_cache(env: dict[str, str]) -> dict: 116 """ 117 Compute a hash from the environment after excluding irrelevant/insecure 118 environment variables to ensure we don't omit a variable 119 """ 120 excluded_variables = { -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/omnibus.py line 106
- Likely real
- Yes, 91% confidence
Possible hardcoded password: 'App-specific password for notarization'
105 'NOTARIZATION_ATTEMPTS': 'Number of retries for notarization steps', 106 'NOTARIZATION_PWD': 'App-specific password for notarization', 107 'NOTARIZATION_TIMEOUT': 'Timeout for xcrun notarytool wait', 108 'TEAM_ID': 'Apple developer team ID used for notarization', 109 'KEYCHAIN_NAME': 'Name of the ephemeral keychain holding signing certificates', 110 'KEYCHAIN_PWD': 'Password for the ephemeral signing keychain', 111 }, 112 } 113 114 115 def _get_environment_for_cache(env: dict[str, str]) -> dict: 116 """ -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/omnibus.py line 20
- Likely real
- Yes, 89% confidence
Possible hardcoded password: 'OIDC token used by the Bazel credential helper to authenticate against the Buildbarn remote cache'
19 'BAZELISK_HOME': "Runner-dependent cache path used by `bazelisk` to manage `bazel` installations", 20 'BUILDBARN_ID_TOKEN': "OIDC token used by the Bazel credential helper to authenticate against the Buildbarn remote cache", 21 'CI': "dda and `bazel` rely on this to be able to tell whether they're running on CI and adapt behavior", 22 'GITLAB_CI': "dda relies on this to be able to tell whether it's running on GitLab CI specifically and adapt behavior", 23 'DD_CC': 'Points at c compiler', 24 'DD_CXX': 'Points at c++ compiler', 25 'GONOSUMDB': 'Go module checksum bypass, set by .adms/go/gitlab.yaml and forwarded to Bazel via --repo_env', 26 'GOPRIVATE': 'Go private module patterns, set by .adms/go/gitlab.yaml and forwarded to Bazel via --repo_env', 27 'GOPROXY': 'Go module proxy, set by .adms/go/gitlab.yaml and forwarded to Bazel via --repo_env', 28 'SKIP_PKG_COMPRESSION': 'Skip package XZ compression (set to true for faster local builds)', 29 'DDA_NO_DYNAMIC_DEPS': 'Variable affecting dda behavior', 30 'E2E_COVERAGE_PIPELINE': 'Used to do a special build of the agent to generate coverage data', 31 'DEPLOY_AGENT': 'Used to apply higher compression level for deployed artifacts', 32 'FORCED_PACKAGE_COMPRESSION_LEVEL': 'Used as an override for the compression level of artifacts', 33 'GEM_HOME': 'rvm / Ruby stuff to make sure Omnibus itself runs correctly', 34 'GEM_PATH': 'rvm / Ruby stuff to make sure Omnibus itself runs correctly', 35 'HOME': 'Home directory might be used by invoked programs such as git', 36 'INSTALL_DIR': 'Used by Omnibus to determine the target install directory when building the package', 37 'INTEGRATIONS_WHEELS_STORAGE': 'Storage tier ("dev" or "stable") for integration dependency wheels, expanded by pip in lockfiles', 38 'MY_RUBY_HOME': 'rvm / Ruby stuff to make sure Omnibus itself runs correctly', 39 'OMNIBUS_FORCE_PACKAGES': 'Force Omnibus to build actual packages', 40 'OMNIBUS_GIT_CACHE_DIR': 'Local directory used by Omnibus for the local git cache', 41 'OMNIBUS_PACKAGE_ARTIFACT_DIR': 'Directory to take the base artifact from on "packaging-only" mode', 42 'PACKAGE_ARCH': 'Target architecture', 43 'PATH': 'Needed to find binaries', 44 'PKG_CONFIG_LIBDIR': 'pkgconfig variable', 45 'PKG_CONFIG_PATH': 'pkgconfig variable', 46 'PYTHONUTF8': 'Hint for Python to use UTF-8', 47 'RUBY_VERSION': 'Used by Omnibus / Gemspec', 48 'S3_OMNIBUS_CACHE_ANONYMOUS_ACCESS': 'Use to determine whether Omnibus can write to the artifact cache', 49 'S3_OMNIBUS_CACHE_BUCKET': 'Points at bucket used for Omnibus source artifacts', 50 'SSH_AUTH_SOCK': 'Developer environments configure Git to use SSH authentication', 51 'XDG_CACHE_HOME': "Runner-dependent cache path used by `bazel` (natively on POSIX OSes, emulated on Windows)", 52 'rvm_path': 'rvm / Ruby stuff to make sure Omnibus itself runs correctly', 53 'rvm_bin_path': 'rvm / Ruby stuff to make sure Omnibus itself runs correctly', 54 'rvm_prefix': 'rvm / Ruby stuff to make sure Omnibus itself runs correctly', 55 'rvm_version': 'rvm / Ruby stuff to make sure Omnibus itself runs correctly', 56 'CI_JOB_ID': 'CI Job ID', 57 'CI_PROJECT_NAME': 'CI Project Name', 58 'CI_JOB_NAME_SLUG': 'CI Job Name Slug', 59 } 60 61 OS_SPECIFIC_ENV_PASSTHROUGH = { 62 'win32': { -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /.dda/extend/pythonpath/lab/providers/local/kind.py line 100
- Likely real
- Yes, 83% confidence
Detects fully silent process execution (suppressing all output channels) [threat-process-spawn-silent]
retcode = app.subprocess.attach( ["docker", "ps"], stderr=subprocess.DEVNULL, stdout=subprocess.DEVNULL, check=False ).returncode if retcode != 0: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/e2e_framework_tool_tests.py line 82
- Likely real
- Yes, 70% confidence
Possible hardcoded password: '/tmp/pass'
81 # Empty is a valid passphrase, so presence -- not truthiness -- is what counts. 82 for ambient in ({"PULUMI_CONFIG_PASSPHRASE": ""}, {"PULUMI_CONFIG_PASSPHRASE_FILE": "/tmp/pass"}): 83 with self.subTest(ambient=ambient), mock.patch.dict("os.environ", ambient, clear=True): -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/ci.py line 10
- Likely real
- Yes, 52% confidence
Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
9 import urllib.parse 10 import xml.etree.ElementTree as ET 11 from collections import defaultdict -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kmt.py line 15
- Likely real
- Yes, 52% confidence
Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
14 import time 15 import xml.etree.ElementTree as ET 16 from collections import defaultdict -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/junit_upload_core.py line 7
- Likely real
- Yes, 52% confidence
Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
6 import tempfile 7 import xml.etree.ElementTree as ET 8 from collections import defaultdict -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/bazel_tests.py line 4
- Likely real
- Yes, 52% confidence
Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
3 import unittest 4 import xml.etree.ElementTree as ET 5 from pathlib import Path -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/bazel.py line 7
- Likely real
- Yes, 52% confidence
Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
6 import tempfile 7 import xml.etree.ElementTree as ET 8 from pathlib import Path -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/package/url.py line 2
- Likely real
- Yes, 51% confidence
Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
1 import tempfile 2 import xml.etree.ElementTree as ET 3 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/virustotal.py line 172
- Likely real
- Yes, 51% confidence
Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
171 ): 172 import xml.etree.ElementTree as ET 173 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/e2e_framework_tool_tests.py line 82
- Likely real
- Uncertain, 45% confidence
Possible hardcoded password: ''
81 # Empty is a valid passphrase, so presence -- not truthiness -- is what counts. 82 for ambient in ({"PULUMI_CONFIG_PASSPHRASE": ""}, {"PULUMI_CONFIG_PASSPHRASE_FILE": "/tmp/pass"}): 83 with self.subTest(ambient=ambient), mock.patch.dict("os.environ", ambient, clear=True): -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/agent_ci_api.py line 104
- Likely real
- Uncertain, 44% confidence
Possible hardcoded password: ''
103 104 token = '' 105 if not is_local: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/renovate.py line 477
- Likely real
- Probably noise, 28% confidence
Try, Except, Continue detected.
476 result = eval(expr, {"__builtins__": {}}, namespace) # noqa: S307 — namespace is preamble-only scalars 477 except Exception: 478 continue 479 if isinstance(result, str) and result.startswith("http"): -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/go_mod_formatter_tests.py line 49
- Likely real
- Probably noise, 25% confidence
subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell
48 assert len(output) == 0, output 49 subprocess.run('rm ./tasks/unit_tests/testdata/go_mod_formatter/format_package_test/go.mod', shell=True) 50 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/go_mod_formatter_tests.py line 62
- Likely real
- Probably noise, 25% confidence
subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell
61 assert len(output) == 0, output 62 subprocess.run('rm ./tasks/unit_tests/testdata/go_mod_formatter/format_package_test/go.mod', shell=True) 63 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/go_mod_formatter_tests.py line 25
- Likely real
- Probably noise, 24% confidence
subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell
24 subprocess.run( 25 'rm ./tasks/unit_tests/testdata/go_mod_formatter/format_package_test/go.mod', shell=True, capture_output=True 26 ) 27 p = subprocess.run(f"cp {src} {dest}", shell=True) 28 assert p.returncode == 0 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /.dda/extend/pythonpath/lab/providers/local/kind.py line 238
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
237 """Check if the developer environment is running.""" 238 import subprocess 239 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /bazel/rules/go_mod_tidy_all/go_mod_tidy_all.py line 12
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
11 from datetime import timedelta 12 from subprocess import PIPE, CalledProcessError 13 from traceback import format_exception_only -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/bpftool.py line 6
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
5 import json 6 import subprocess 7 from typing import Dict, Generator, List, Optional -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/bpftool.py line 14
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
13 from .streaming import iter_json_objects 14 from ..subprocess_utils import safe_subprocess_run 15 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/bpftool_downloader.py line 15
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
14 from ..logging_config import logger 15 from ..subprocess_utils import safe_subprocess_run 16 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/ebpf_backend.py line 11
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
10 from ..logging_config import logger 11 from ..subprocess_utils import safe_subprocess_run 12 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/system_probe.py line 6
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
5 import os 6 import subprocess 7 from typing import Dict, Generator, List, Optional -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/system_probe.py line 14
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
13 from ..models import ConnTuple 14 from ..subprocess_utils import safe_subprocess_run 15 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /omnibus/python-scripts/packages_tests.py line 88
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
87 def test_run_command_failure_returns_nonzero_rc(self): 88 import subprocess 89 with patch('subprocess.run') as mock_run: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/utils.py line 23
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
22 from pathlib import Path 23 from subprocess import check_output, list2cmdline 24 from types import SimpleNamespace -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/go_tests.py line 1
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
1 import subprocess 2 import unittest 3 from unittest.mock import MagicMock, patch -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/junit_tests.py line 4
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
3 from pathlib import Path 4 from subprocess import CalledProcessError 5 from unittest.mock import patch -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/ebpf_backend.py line 5
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
4 5 import subprocess 6 from abc import ABC, abstractmethod -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/junit_upload_core.py line 13
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
12 from shutil import which 13 from subprocess import check_call 14 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/types/types.py line 2
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
1 import re 2 import subprocess 3 from dataclasses import dataclass -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/system_probe.py line 15
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
14 from pathlib import Path 15 from subprocess import check_output 16 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/tools/clang_format.py line 26
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
25 try: 26 from subprocess import DEVNULL # py3k 27 except ImportError: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/static_quality_gates/experimental_gates.py line 802
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
801 import json 802 import subprocess 803 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /.dda/extend/pythonpath/lab/providers/local/kind.py line 10
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
9 import shutil 10 import subprocess 11 import tempfile -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/bpftool_downloader.py line 7
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
6 import platform 7 import subprocess 8 import tarfile -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/e2e_framework/aws/deploy.py line 2
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
1 import os 2 import subprocess 3 from typing import Any -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/e2e_framework/tool.py line 9
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
8 import shutil 9 import subprocess 10 import tempfile -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/bazel_query.py line 7
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
6 import shutil 7 import subprocess 8 import threading -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/coverage.py line 5
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
4 import shutil 5 import subprocess 6 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /.agents/skills/run-e2e/scripts/devenv_e2e.py line 23
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
22 import shutil 23 import subprocess 24 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /.agents/skills/follow-pr/scripts/config.py line 24
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
23 import os 24 import subprocess 25 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/agent_ci_api.py line 5
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
4 import shutil 5 import subprocess 6 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/gotest.py line 15
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
14 import signal 15 import subprocess 16 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/install_tasks.py line 3
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
2 import os 3 import subprocess 4 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/subprocess_utils.py line 12
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
11 import select 12 import subprocess 13 import time -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /bazel/tools/healthcheck/macos.py line 19
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
18 import re 19 import subprocess 20 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /bazel/tools/healthcheck/linux.py line 16
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
15 import re 16 import subprocess 17 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /bazel/rules/macos/pkg/build_mac_pkg.py line 24
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
23 import shutil 24 import subprocess 25 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /bazel/rules/ebpf/clang_with_unused_inputs.py line 11
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
10 import shlex 11 import subprocess 12 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /.dda/extend/commands/build/docker/__init__.py line 29
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
28 import shutil 29 import subprocess 30 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /.agents/skills/triage-ci-failure/scripts/incidents.py line 35
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
34 import re 35 import subprocess 36 import sys -
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/python_version.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Dockerfiles/otel-agent/Dockerfile
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/k8s_versions.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/kernel_matrix_testing/download.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/kernel_matrix_testing/provision/bata24.sh
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/kernel_matrix_testing/vmconfig.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/agent.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/system_probe.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/libs/common/download.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/libs/common/utils.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/licenses.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/gpu.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/libs/ciproviders/gitlab_api.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/libs/package/url.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /pkg/config/legacy/testdata/config.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /pkg/fleet/installer/setup/install.sh
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Dockerfiles/dogstatsd/alpine/probe.sh
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/renovate.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tools/host-profiler/Dockerfile
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /q_branch/gadget-k8s-host.lima.yaml
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /.gitlab/.pre/deps_build/deps_build.yml
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /.gitlab/.pre/deps_fetch/deps_fetch.yml
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cmd/agent/install_script.sh
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/bpftool_downloader.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /deps/cacerts/update_cacerts.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/cluster_agent.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/unit_tests/url_tests.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/omnibus.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/collector.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/install_tasks.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/gotest.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/unit_tests/download_tests.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/unit_tests/omnibus_tests.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/unit_tests/release_tests.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
No findings match these filters.