MalDet · Static Security Report
The repository has a very low vulnerability score of 0.0, which means there are no obvious code errors that could be easily exploited by attackers. However, the high malicious-pattern score of 86.0 indicates that the code contains many signs of intentional bad behavior rather than just standard mistakes. The most serious issues involve potential credential harvesting and download-and-execute attacks, as well as suspicious dependencies like typosquatting names for popular libraries. These findings suggest the code may be actively trying to steal secrets or run malicious scripts, which is a much more dangerous situation than simple insecure coding patterns.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| yara | Signatures of malicious behaviour in source files | 11 | 0 | 37 | 48 |
| guarddog | Malicious package and install-time behaviour | 3 | 9 | 0 | 12 |
| dep_checker | Vulnerable, unpinned or typosquatted dependencies | 2 | 1 | 8 | 11 |
15 of 71 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | guarddog | Detects keylogging and input capture patterns [threat-runtime-keylogging] | 3 | /homeassistant/components/keyboard_remote/__init__.py:10 |
| high | dep_checker | Typosquatting: 'httpx2' is suspiciously similar to 'httpx' | 2 | pyproject.toml |
| high | yara | YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA c | 3 | /homeassistant/components/pushsafer/notify.py |
| high | yara | YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed | 2 | /homeassistant/helpers/template/extensions/base64.py |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 6 | /CLAUDE.md |
| medium | guarddog | Detects extensive system/network enumeration activities [threat-runtime-enumeration] | 3 | /homeassistant/components/nmap_tracker/__init__.py:12 |
| medium | guarddog | Detects unicode homoglyphs and uncommon characters used for obfuscation [threat-runtime-obfuscation-unicode] | 1 | /homeassistant/const.py:561 |
| medium | guarddog | Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration] | 3 | /homeassistant/components/marketplace/system_health.py:46 |
| medium | guarddog | Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links] | 2 | /homeassistant/components/route53/__init__.py:98 |
| medium | dep_checker | Unpinned dependency: '-c homeassistant/package_constraints.txt' has no version lock — supply chain risk | 1 | requirements.txt:3 |
| low | dep_checker | Loose version constraint: 'certifi>=2021.5.30' — attacker could push malicious update | 2 | pyproject.toml |
| low | dep_checker | Loose version constraint: 'packaging>=23.1' — attacker could push malicious update | 2 | requirements.txt:39 |
| low | dep_checker | Loose version constraint: 'typing-extensions>=4.16.0,<5.0' — attacker could push malicious update | 2 | requirements.txt:58 |
| low | dep_checker | Loose version constraint: 'urllib3>=2.0' — attacker could push malicious update | 2 | requirements.txt:60 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 37 | /homeassistant/components/route53/__init__.py |