MalDet · Static Security Report
All 18 findings look like noise (low confidence) — nothing here likely needs attention.
Generated from finding counts. A plain-English summary was not available for this scan.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| dep_checker | Vulnerable, unpinned or typosquatted dependencies | 0 | 0 | 16 | 16 |
| yara | Signatures of malicious behaviour in source files | 2 | 0 | 0 | 2 |
0 of 18 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | yara | YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed | 1 | /dist/index.js |
| high | yara | YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together | 1 | /dist/index.js |
| low | dep_checker | Loose version constraint: 'globals^17.11.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'tslib^2.8.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'tar^7.5.22' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'prettier^3.9.6' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'lodash^4.18.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'lint-staged^17.3.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'husky^9.1.7' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@actions/cache^6.0.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'eslint^10.8.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'esbuild^0.28.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'better-npm-audit^3.11.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@eslint/js^10.0.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@eslint/eslintrc^3.3.6' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@actions/tool-cache^4.0.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@actions/exec^3.0.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@actions/core^3.0.1' — attacker could push malicious update | 1 | package.json |