MalDet · Static Security Report
This repository has two major security issues that are serious enough to prevent safe use. The most critical problem is that the code relies on outdated and insecure libraries like pyCrypto, which have been deprecated by their developers. Additionally, there are multiple instances of dangerous shell commands being used in subprocess calls, which can lead to unexpected behavior or injection attacks. While some findings suggest the code might be trying to hide malicious intent, the majority of these issues stem from poor security practices rather than intentional attacks. The overall vulnerability risk score is 426.0, indicating a high level of insecurity that requires immediate attention before the code can be considered safe for production use.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| bandit | Insecure coding patterns in Python source | 15 | 51 | 127 | 193 |
| semgrep | Insecure coding patterns across many languages | 17 | 30 | 0 | 47 |
| guarddog | Malicious package and install-time behaviour | 0 | 8 | 5 | 13 |
| yara | Signatures of malicious behaviour in source files | 4 | 0 | 1 | 5 |
| dep_checker | Vulnerable, unpinned or typosquatted dependencies | 0 | 2 | 0 | 2 |
134 of 260 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | bandit | The pyCrypto library and its module AES are no longer actively maintained and have been deprecated. Consider using pyca/cryptography library. | 7 | /Windows/lazagne/softwares/browsers/chromium_based.py:19 |
| high | bandit | The pyCrypto library and its module unpad are no longer actively maintained and have been deprecated. Consider using pyca/cryptography library. | 2 | /Windows/lazagne/softwares/browsers/chromium_based.py:21 |
| high | semgrep | The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using `defusedxml`. | 12 | /Windows/lazagne/softwares/sysadmin/rdpmanager.py:102 |
| high | semgrep | Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. | 4 | /Mac/lazagne/config/run.py:43 |
| high | semgrep | Found 'subprocess' function 'check_output' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. | 1 | /Mac/lazagne/softwares/browsers/chrome.py:82 |
| high | bandit | Starting a process with a shell, possible injection detected, security issue. | 1 | /Windows/lazagne/softwares/sysadmin/iiscentralcertp.py:39 |
| high | bandit | subprocess call with shell=True identified, security issue. | 5 | /Mac/lazagne/config/run.py:43 |
| high | yara | YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed | 4 | /Windows/lazagne/config/execute_cmd.py |
| medium | semgrep | Detected SHA1 hash algorithm which is considered insecure. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead. | 1 | /Windows/lazagne/softwares/browsers/chromium_based.py:177 |
| medium | semgrep | It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`. | 2 | /Windows/lazagne/softwares/sysadmin/mRemoteNG.py:139 |
| medium | guarddog | Detects extensive system/network enumeration activities [threat-runtime-enumeration] | 3 | /Linux/lazagne/config/homes.py:12 |
| medium | bandit | Using xml.dom.minidom.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.dom.minidom.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called | 1 | /Windows/lazagne/softwares/sysadmin/mRemoteNG.py:124 |
| medium | bandit | Using xml.dom.minidom.parseString to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.dom.minidom.parseString with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called | 1 | /Windows/lazagne/softwares/sysadmin/iiscentralcertp.py:77 |
| medium | bandit | The pyCrypto library and its module SHA1 are no longer actively maintained and have been deprecated. Consider using pyca/cryptography library. | 1 | /Windows/lazagne/softwares/browsers/chromium_based.py:20 |
| medium | guarddog | Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] | 5 | /Windows/lazagne/softwares/git/gitforwindows.py:49 |
| medium | bandit | Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called | 12 | /Windows/lazagne/softwares/memory/libkeepass/common.py:251 |
| medium | dep_checker | Unpinned dependency: 'pycryptodome' has no version lock — supply chain risk | 1 | requirements.txt:8 |
| medium | dep_checker | Unpinned dependency: 'pyasn1' has no version lock — supply chain risk | 1 | requirements.txt:3 |
| medium | semgrep | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. | 17 | /Linux/lazagne/softwares/browsers/mozilla.py:313 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 6 | /.github/workflows/WinCompile.yml:14 |
| medium | bandit | Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called | 3 | /Windows/lazagne/softwares/memory/libkeepass/kdb4.py:324 |
| medium | bandit | Use of weak SHA1 hash for security. Consider usedforsecurity=False | 18 | /Linux/lazagne/softwares/browsers/mozilla.py:315 |
| medium | bandit | Use of weak MD5 hash for security. Consider usedforsecurity=False | 12 | /Windows/lazagne/softwares/windows/creddump7/win32/hashdump.py:196 |
| medium | semgrep | Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code. | 3 | /Windows/lazagne/config/soft_import_module.py:13 |
| medium | bandit | Possible SQL injection vector through string-based query construction. | 2 | /Linux/lazagne/config/lib/memorpy/WinProcess.py:151 |
| medium | semgrep | Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'. | 1 | /Windows/lazagne/softwares/windows/creddump7/newobj.py:59 |
| medium | bandit | Probable insecure usage of temp file/directory. | 1 | /Linux/lazagne/softwares/browsers/chromium_based.py:141 |
| low | bandit | Using parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace parse with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called. | 5 | /Windows/lazagne/softwares/sysadmin/apachedirectorystudio.py:2 |
| low | bandit | Using minidom to parse untrusted XML data is known to be vulnerable to XML attacks. Replace minidom with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called. | 1 | /Windows/lazagne/softwares/sysadmin/iiscentralcertp.py:9 |
| low | bandit | Possible hardcoded password: 'anonymous' | 1 | /Windows/lazagne/softwares/sysadmin/ftpnavigator.py:40 |
| low | bandit | Possible hardcoded password: 'qinda' | 2 | /Windows/lazagne/softwares/databases/dbvis.py:20 |
| low | bandit | Possible hardcoded password: 'S-1-5-18' | 1 | /Windows/lazagne/config/change_privileges.py:112 |
| low | bandit | Possible hardcoded password: 'mR3m' | 1 | /Windows/lazagne/softwares/sysadmin/mRemoteNG.py:36 |
| low | bandit | Possible hardcoded password: 'connection' | 2 | /Windows/lazagne/softwares/multimedia/eyecon.py:61 |
| low | bandit | Possible hardcoded password: '{"name":"master-password","value":"(.*)","type":"P","designation":"password"}' | 1 | /Windows/lazagne/softwares/memory/onepassword.py:39 |
| low | bandit | Possible hardcoded password: 'Password' | 8 | /Linux/lazagne/softwares/databases/dbvis.py:56 |
| low | guarddog | Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info] | 2 | /Linux/lazagne/config/write_output.py:68 |
| low | guarddog | Detects memory scraping and credential dumping from process memory [threat-process-memory] | 3 | /Linux/lazagne/config/lib/memorpy/WinProcess.py:238 |
| low | bandit | Possible hardcoded password: '{"name":"account-key","value":"(.{2}-.{6}-.{6}-.{5}-.{5}-.{5}-.{5})","type":"T"}' | 1 | /Windows/lazagne/softwares/memory/onepassword.py:31 |
| low | bandit | Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called. | 23 | /Windows/lazagne/softwares/wifi/wifi.py:6 |
| low | bandit | Possible hardcoded password: '0' | 1 | /Linux/lazagne/softwares/mails/clawsmail.py:134 |
| low | bandit | Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called. | 2 | /Windows/lazagne/softwares/sysadmin/rdpmanager.py:101 |
| low | bandit | Possible hardcoded password: '' | 14 | /Windows/lazagne/softwares/sysadmin/vnc.py:131 |
| low | bandit | Possible hardcoded password: 'None' | 3 | /Windows/lazagne/config/DPAPI/masterkey.py:244 |
| low | bandit | Try, Except, Continue detected. | 16 | /Linux/lazagne/config/homes.py:114 |
| low | bandit | subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell | 2 | /Linux/lazagne/config/lib/memorpy/OSXProcess.py:87 |
| low | bandit | Consider possible security implications associated with the subprocess module. | 10 | /Windows/lazagne/softwares/wifi/wifi.py:7 |
| low | bandit | Starting a process with a partial executable path | 3 | /Linux/lazagne/config/lib/memorpy/OSXProcess.py:87 |
| low | bandit | subprocess call - check for execution of untrusted input. | 4 | /Windows/lazagne/softwares/sysadmin/iisapppool.py:27 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 1 | /.travis.yml |
| low | bandit | Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. | 26 | /Linux/lazagne/softwares/browsers/mozilla.py:327 |