MalDet · Static Security Report
110 findings likely need attention, 75 look like noise. Most notable: The application builds a file path from potentially untrusted data, which can lead to a... (100% confidence).
Generated from finding counts. A plain-English summary was not available for this scan.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 7 | 83 | 0 | 90 |
| bandit | Insecure coding patterns in Python source | 0 | 11 | 49 | 60 |
| yara | Signatures of malicious behaviour in source files | 13 | 0 | 13 | 26 |
| guarddog | Malicious package and install-time behaviour | 7 | 13 | 1 | 21 |
110 of 197 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as confi | 3 | /core/httpd.py:1329 |
| high | semgrep | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. | 1 | /core/update.py:78 |
| high | guarddog | Detects suspicious autostart persistence mechanisms [threat-filesystem-autostart] | 3 | /sensor/tools/gen_vectors.py:413 |
| high | guarddog | Detects cryptocurrency mining activity [threat-process-cryptomining] | 3 | /html/js/demo.js:510 |
| high | guarddog | Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec] | 1 | /core/settings.py:155 |
| high | semgrep | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition | 1 | /core/disktrails.py:54 |
| high | semgrep | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. | 2 | /docker/Dockerfile:108 |
| high | yara | YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code | 2 | /sensor/src/selftest.rs |
| high | yara | YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed | 1 | /core/settings.py |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 6 | /.github/workflows/release.yml |
| high | yara | YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together | 1 | /html/js/thirdparty.min.js |
| high | yara | YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this | 3 | /sensor/tools/gen_vectors.py |
| medium | guarddog | Detects extensive system/network enumeration activities [threat-runtime-enumeration] | 3 | /core/settings.py:124 |
| medium | guarddog | Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links] | 5 | /html/js/demo.js:9 |
| medium | guarddog | Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] | 5 | /core/testing.py:252 |
| medium | bandit | Use of insecure cipher mode cryptography.hazmat.primitives.ciphers.modes.ECB. | 1 | /core/quic_sni.py:148 |
| medium | semgrep | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | 4 | /core/common.py:263 |
| medium | semgrep | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. | 1 | /sensor/tools/refnet.py:273 |
| medium | semgrep | Detected possible formatted SQL query. Use parameterized queries instead. | 1 | /core/disktrails.py:54 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 76 | /.github/workflows/compat.yml:197 |
| medium | bandit | Use of weak MD5 hash for security. Consider usedforsecurity=False | 3 | /core/provenance.py:46 |
| medium | bandit | Use of weak SHA1 hash for security. Consider usedforsecurity=False | 1 | /sensor/tools/refnet.py:273 |
| medium | bandit | Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. | 4 | /core/common.py:263 |
| medium | semgrep | Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'. | 1 | /core/settings.py:507 |
| medium | bandit | Possible binding to all interfaces. | 2 | /core/doctor.py:117 |
| low | bandit | Possible hardcoded password: '9ab3cd9d67bf49d01f6a2e33d0bd9bc804ddbe6ce1ff5d219c42624851db5dbc' | 1 | /core/httpd.py:420 |
| low | guarddog | Detects fully silent process execution (suppressing all output channels) [threat-process-spawn-silent] | 1 | /sensor/tools/refnet.py:529 |
| low | bandit | Starting a process without a shell. | 1 | /core/testing.py:522 |
| low | bandit | Try, Except, Continue detected. | 3 | /core/meta.py:75 |
| low | bandit | subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell | 4 | /core/settings.py:422 |
| low | bandit | Consider possible security implications associated with the subprocess module. | 8 | /core/httpd.py:22 |
| low | bandit | Starting a process with a partial executable path | 11 | /core/settings.py:415 |
| low | bandit | subprocess call - check for execution of untrusted input. | 15 | /sensor/tools/refnet.py:529 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 13 | /sensor/tools/check_redistribution.py |
| low | bandit | Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. | 6 | /core/trailsbin.py:35 |