MalDet · Static Security Report
This repository has been flagged as having high malicious-pattern risk, which means there are strong signs that the code was intentionally written to be dangerous rather than just containing ordinary insecure coding mistakes. While the vulnerability risk score is low and indicates only minor issues like unsafe YAML loading or XML parsing, the high malicious pattern score suggests the presence of specific threats such as credential harvesting, memory scraping, and deliberate attempts to download and execute remote files. You should treat this code with extreme caution because it contains multiple dangerous patterns that could be exploited by attackers, even though the overall vulnerability count is relatively small. The scan identified several critical issues including a YARA rule that detects credential harvesters, a pattern for downloading files and running them, and memory scraping techniques used to steal data from running processes. Given these specific high-risk indicators, it is not safe to use this code in production environments without thorough manual review and remediation of the identified threats.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| bandit | Insecure coding patterns in Python source | 0 | 6 | 95 | 101 |
| yara | Signatures of malicious behaviour in source files | 27 | 0 | 33 | 60 |
| guarddog | Malicious package and install-time behaviour | 4 | 1 | 3 | 8 |
| dep_checker | Vulnerable, unpinned or typosquatted dependencies | 0 | 0 | 1 | 1 |
10 of 170 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | guarddog | Detects HTTP/HTTPS URL dependencies in package.json (dependency confusion, untrusted sources) [threat-npm-http-dependency] | 1 | /src/ui/package.json:62 |
| high | guarddog | Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec] | 3 | /scripts/srt/setup.py:19 |
| high | yara | YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA c | 12 | /src/lambda/discovery_processor/index.py |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 12 | /scripts/setup/dev_setup_ubuntu.sh |
| high | yara | YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this | 3 | /scripts/setup/dev_setup_al2023.sh |
| medium | bandit | Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load(). | 1 | /scripts/check_data_plane_tags.py:195 |
| medium | guarddog | Detects heavy code obfuscation techniques [threat-runtime-obfuscation-general] | 1 | /lib/idp_common_pkg/idp_common/ocr/document_converter.py:1823 |
| medium | bandit | Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. | 2 | /scripts/ux_recorder.py:610 |
| medium | bandit | Possible SQL injection vector through string-based query construction. | 1 | /scripts/check_threat_model_currency.py:218 |
| medium | bandit | Probable insecure usage of temp file/directory. | 2 | /scripts/ux_recorder.py:130 |
| low | bandit | Using escape to parse untrusted XML data is known to be vulnerable to XML attacks. Replace escape with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called. | 1 | /scripts/ux_recorder_render.py:80 |
| low | guarddog | Detects memory scraping and credential dumping from process memory [threat-process-memory] | 3 | /lib/idp_common_pkg/idp_common/ocr/service.py:1409 |
| low | bandit | Try, Except, Continue detected. | 4 | /scripts/sdlc/codebuild_deployment.py:1534 |
| low | bandit | Consider possible security implications associated with the subprocess module. | 22 | /scripts/ux_recorder_render.py:74 |
| low | bandit | Starting a process with a partial executable path | 20 | /lib/idp_sdk/idp_sdk/operations/publish.py:52 |
| low | bandit | subprocess call - check for execution of untrusted input. | 36 | /scripts/srt/setup.py:178 |
| low | dep_checker | Loose version constraint: 'basedpyright^1.32.1' — attacker could push malicious update | 1 | package.json |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 33 | /feature-platform/sample-feature/ui-deployer/handler.py |
| low | bandit | Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. | 12 | /notebooks/misc/standalone_sharded_extraction_demo.py:148 |