MalDet · Static Security Report
16 findings likely need attention, 67 look like noise. Most notable: Executing non-constant commands. This can lead to command injection. (43% confidence).
Generated from finding counts. A plain-English summary was not available for this scan.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| dep_checker | Vulnerable, unpinned or typosquatted dependencies | 0 | 0 | 64 | 64 |
| semgrep | Insecure coding patterns across many languages | 1 | 16 | 0 | 17 |
| yara | Signatures of malicious behaviour in source files | 3 | 0 | 0 | 3 |
16 of 84 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Executing non-constant commands. This can lead to command injection. | 1 | /scripts/koel-init.php:7 |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 3 | /CLAUDE.md |
| medium | semgrep | RegExp() called with a `route` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle | 1 | /resources/assets/js/router.ts:71 |
| medium | semgrep | Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. | 8 | /resources/assets/js/components/artist/ArtistInfo.vue:11 |
| medium | semgrep | This pnpm workspace configuration does not set a minimum release age. Newly published packages can be malicious or unstable. Add `minimumReleaseAge: 10080` (minutes) to wait at least seven days before installing newly published package versions. Added in: v10.16.0 Reference: https://pnpm.io/settings | 1 | /pnpm-workspace.yaml:6 |
| medium | semgrep | A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardw | 2 | /config/database.php:140 |
| medium | semgrep | Missing or incorrect trustPolicy. Set `trustPolicy: no-downgrade` to prevent malicious package updates from downgrading security settings. Added in: v10.21.0 Reference: https://pnpm.io/settings#trustpolicy | 1 | /pnpm-workspace.yaml:6 |
| medium | semgrep | Missing or incorrect blockExoticSubdeps. Set `blockExoticSubdeps: true` to transitive dependencies from being installed from untrusted sources. Added in: v10.26.0 Reference: https://pnpm.io/settings#blockexoticsubdeps | 1 | /pnpm-workspace.yaml:6 |
| medium | semgrep | Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. | 1 | /resources/assets/js/services/httpUpload.ts:73 |
| medium | semgrep | File name based on user input risks server-side request forgery. | 1 | /server.php:15 |
| low | dep_checker | Loose version constraint: '@testing-library/user-event^14.6.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@fortawesome/free-regular-svg-icons^6.7.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@testing-library/vue^6.6.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'laravel-echo^2.1.6' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'jsdom^26.1.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'laravel-vite-plugin^2.1.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'lodash-es^4.18.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'lucide-vue-next^0.577.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'marked^17.0.4' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'nouislider^14.7.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'nprogress^0.2.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'postcss-mixins^10.0.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'postcss-nested^6.2.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'postcss^8.5.23' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'pusher-js^8.6.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'qrcode^1.5.4' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'rollup-plugin-visualizer^6.0.3' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'style-observer^0.1.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'tailwindcss^4.3.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'three^0.146.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'tiny-typed-emitter^2.1.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'typescript^5.8.3' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'vitepress-plugin-llms^1.11.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'vitepress^1.6.3' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'vue-advanced-cropper^2.8.9' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'vue-chartjs^5.3.4' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'vue-tsc^3.2.5' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'vue^3.5.44' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'youtube-player^5.6.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@tailwindcss/postcss^4.3.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@types/three^0.144.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@types/pusher-js^4.2.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@types/nprogress^0.2.3' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@types/lodash-es^4.17.12' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@tiptap/vue-3^3.31.4' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@tiptap/starter-kit^3.31.4' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@tiptap/pm^3.31.4' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@tailwindcss/vite^4.3.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@types/youtube-player^5.5.11' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@laravel/echo-vue^2.1.6' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@fortawesome/vue-fontawesome^3.0.8' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@fortawesome/free-solid-svg-icons^6.7.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@fortawesome/free-brands-svg-icons^6.7.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@fortawesome/fontawesome-svg-core^6.7.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@floating-ui/dom^1.7.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@faker-js/faker^10.5.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@commitlint/config-conventional^19.8.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'dompurify^3.4.17' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@commitlint/cli^19.8.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'jest-serializer-vue^2.0.2' — attacker could push malicious update | 1 | package.json |
Showing the 60 most significant of 74 distinct findings. The counts in the previous section cover all of them.