MalDet · Static Security Report
This repository has a high vulnerability score of 108, which means that insecure coding patterns are present and could be exploited by attackers to steal secrets or inject malicious code. While the malicious-pattern risk is very low at 1.0, suggesting the code does not appear to be intentionally harmful, the majority of the issues found are standard security mistakes rather than signs of a hidden attack. Most of these problems involve common practices like using unverified user data in commands, hardcoding private keys, or failing to escape HTML content properly when dealing with user input. The scan also identified specific risks such as missing TLS version settings and potential denial-of-service attacks that could be mitigated by following the recommendations listed for each finding.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 12 | 30 | 6 | 48 |
| yara | Signatures of malicious behaviour in source files | 2 | 0 | 3 | 5 |
| guarddog | Malicious package and install-time behaviour | 0 | 0 | 1 | 1 |
20 of 54 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use | 1 | /.github/workflows/release.yml:38 |
| high | semgrep | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. | 5 | /internal/plugin/runtime_subprocess_getter.go:85 |
| high | semgrep | Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file. | 6 | /pkg/registry/testdata/tls/server.key:1 |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 1 | /Makefile |
| high | yara | YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this | 1 | /pkg/chart/loader/archive/archive.go |
| medium | semgrep | Variable `results` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference | 2 | /pkg/action/upgrade.go:469 |
| medium | semgrep | File creation in shared tmp directory without using `io.CreateTemp`. | 1 | /internal/plugin/testdata/src/extismv1-test/main.go:25 |
| medium | semgrep | This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: | 4 | /.github/dependabot.yml:5 |
| medium | semgrep | `MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as the minimum. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web server must support legacy clients with unsuppor | 5 | /pkg/chart/common/util/jsonschema.go:70 |
| medium | semgrep | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not automatically escape HTML content, which can leave your application vuln | 6 | /pkg/cmd/printer.go:21 |
| medium | semgrep | The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS="," read -a my_array'. | 1 | /scripts/validate-license.sh:17 |
| medium | semgrep | Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. | 3 | /internal/plugin/installer/extractor.go:168 |
| medium | semgrep | Do not use `math/rand`. Use `crypto/rand` instead. | 2 | /internal/release/v2/mock.go:20 |
| medium | semgrep | In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, | 6 | /pkg/cmd/testdata/testcharts/chart-with-template-with-invalid-template-expr/templates/alpine-pod.yaml:7 |
| low | guarddog | Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read] | 1 | /pkg/cli/environment.go:103 |
| low | semgrep | When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resou | 6 | /pkg/cmd/testdata/testcharts/alpine/templates/alpine-pod.yaml:18 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 3 | /scripts/get-helm-3 |