MalDet · Static Security Report
2 findings likely need attention, 12 look like noise. Most notable: This Node.js version file pins a runtime that is affected by CVE-2026-111497 (Brotli de... (95% confidence).
Generated from finding counts. A plain-English summary was not available for this scan.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| dep_checker | Vulnerable, unpinned or typosquatted dependencies | 0 | 0 | 12 | 12 |
| semgrep | Insecure coding patterns across many languages | 1 | 0 | 0 | 1 |
| guarddog | Malicious package and install-time behaviour | 0 | 1 | 0 | 1 |
2 of 14 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | This Node.js version file pins a runtime that is affected by CVE-2026-111497 (Brotli decoder out-of-bounds write, remote code execution) or a floating alias whose patch level cannot be verified. Pin to a fixed release: 22.23.4, 24.22.1, 26.12.1 or later on the same line. Node.js 20 and older, 23 and | 1 | /.mise.toml:2 |
| medium | guarddog | Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration] | 1 | /src/App.tsx:4 |
| low | dep_checker | Loose version constraint: '@tailwindcss/vite^4.0.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@types/node^22.0.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@types/react-dom^19.0.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@types/react^19.0.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@vitejs/plugin-react^6.0.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'lenis^1.3.27' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'oxfmt^0.2.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'react-dom^19.0.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'react^19.0.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'tailwindcss^4.0.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'typescript^5.7.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'vite^8.0.5' — attacker could push malicious update | 1 | package.json |