MalDet · Static Security Report
This repository shows two very different kinds of problems that need to be addressed separately. The most serious issue is that the code contains signs of intentional malicious behavior, such as decoding hidden data and executing it, which suggests the developer may have been trying to hide something or bypass security checks rather than just making a mistake. While the overall vulnerability risk is rated as safe because there are no obvious bugs that could be exploited right now, the high score for malicious patterns indicates that the codebase might be hiding dangerous activities. You should treat this as a potentially risky environment where you need to verify if the suspicious scripts are actually being used and whether the loose version constraints in the dependencies pose any real threat before trusting the system.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| guarddog | Malicious package and install-time behaviour | 4 | 4 | 9 | 17 |
| dep_checker | Vulnerable, unpinned or typosquatted dependencies | 0 | 0 | 16 | 16 |
| yara | Signatures of malicious behaviour in source files | 12 | 0 | 0 | 12 |
17 of 45 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | guarddog | Detects system info collection combined with network exfiltration (hostname/user in HTTP requests) [threat-network-exfil-sysinfo] | 3 | /scripts/qa-focus-evidence.mjs:621 |
| high | guarddog | Detects steganography decode followed by code execution [threat-runtime-obfuscation-steganography] | 1 | /scripts/qa-camera-controls.mjs:115 |
| high | yara | YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed | 12 | /scripts/qa-admin-outlines.mjs |
| medium | guarddog | Detects unicode homoglyphs and uncommon characters used for obfuscation [threat-runtime-obfuscation-unicode] | 1 | /scripts/qa-cctv-v2.mjs:566 |
| medium | guarddog | Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] | 3 | /build/vite.js:96 |
| low | guarddog | Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info] | 3 | /scripts/qa-focus-evidence.mjs:623 |
| low | guarddog | Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read] | 3 | /server/providers/firms.js:51 |
| low | guarddog | Detects fully silent process execution (suppressing all output channels) [threat-process-spawn-silent] | 3 | /server/providers/openai/codex-auth.js:198 |
| low | dep_checker | Loose version constraint: 'sharp^0.35.4' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'ws^8.21.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'vite^6.0.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'vite-plugin-cesium^1.2.23' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@jtarrio/signals^0.10.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'satellite.js^6.0.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'puppeteer^25.10.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'pbf^5.1.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'mgrs^2.1.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'mapillary-js^4.1.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'hls.js^1.7.3' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'egm96-universal^1.1.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'cesium^1.124.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@meri-imperiumi/eccodes-wasm^2.48.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@mapbox/vector-tile^3.0.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@jtarrio/webrtlsdr^3.0.6' — attacker could push malicious update | 1 | package.json |