MalDet

Scan report

cadence-workflow / cadence

Report Rescan
Vulnerability Critical

Could an attacker exploit mistakes in this code?

579 risk score

Strong warning signs. Do not run or install this without a careful review.

High
13
Medium
249
Low
0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Low

Does this code look like it is trying to cause harm?

2 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High
0
Medium
0
Low
5

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview
267 total findings
Likely real
205
Uncertain
59
Likely noise
3

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

This repository has two distinct security issues that need to be addressed before it can be considered safe for production use. The most critical finding is that the code contains 267 vulnerabilities, with the highest risk being missing mutex locks in several functions which could cause the application to crash unexpectedly if a lock is released twice. While these are standard coding errors rather than signs of malicious intent, they represent significant risks that must be fixed immediately. Additionally, there are multiple services running inside containers with writable root filesystems, which allows attackers to potentially modify files or download harmful payloads from the internet. The scan also identified one private key stored in code and several medium-risk findings related to environment variable exposure. To use this repository safely, you should first fix all the missing mutex unlock errors and ensure that no services are running with a writable root filesystem by changing their configuration settings.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

  • Semgrep 262

    Pattern-based code analysis · Vulnerability

  • YARA 3

    Malware signature rules · Malicious pattern

  • GuardDog 2

    Supply-chain attack heuristics · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Large result: showing the top 205 of 267 findings (up to 200 per engine, most severe and most likely real first). Totals above include everything.