MalDet · Static Security Report
This repository has a high vulnerability score of 218.0, which means there are many insecure coding patterns that an attacker could exploit to steal secrets or code. However, the malicious-pattern risk is only 2.0, indicating that these issues likely stem from ordinary mistakes rather than intentional attacks. The most critical findings involve using variable interpolation in workflow files and running unverified commands, which could allow attackers to inject harmful code. While some medium-severity issues exist regarding file deserialization and potential denial-of-service attacks, the overall picture suggests the code is not immediately unsafe for use.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 13 | 100 | 0 | 113 |
| yara | Signatures of malicious behaviour in source files | 3 | 0 | 1 | 4 |
| guarddog | Malicious package and install-time behaviour | 0 | 0 | 2 | 2 |
98 of 119 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use | 1 | /.github/workflows/release-oil-then-cli.yml:25 |
| high | semgrep | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. | 12 | /internal/migrate/tf_importgen_helpers.go:713 |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 2 | /internal/cli/version.go |
| high | yara | YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this | 1 | /cmd/newrelic/command_completion.go |
| medium | semgrep | This Renovate configuration does not set a minimum release age. Newly published packages can be malicious or unstable. Add `"minimumReleaseAge": "7 days"` within a `packageRules` entry to wait 7 days before proposing updates to newly published package versions. Set `"minimumReleaseAge": false` to se | 1 | /.github/renovate.json:15 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 94 | /.github/workflows/e2e-jp.yml:30 |
| medium | semgrep | Deserializing into `interface{}` allows arbitrary data structures and types, which can lead to security vulnerabilities (CWE-502). Use a concrete struct type instead. | 2 | /internal/synthetics/command_monitor.go:99 |
| medium | semgrep | Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. | 1 | /internal/diagnose/helpers.go:97 |
| medium | semgrep | If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to | 1 | /internal/agent/version/version.go:34 |
| medium | semgrep | Do not use `math/rand`. Use `crypto/rand` instead. | 1 | /internal/migrate/tf_importgen_ci_validation.go:7 |
| low | guarddog | Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read] | 2 | /.github/scripts/main.js:11 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 1 | /scripts/brew_formula_pull_request.sh |