MalDet · Static Security Report
This repository has a high vulnerability score of 101.0, which means there are several serious coding errors that could allow an attacker to crash your system or steal secrets. While the code does not appear to be intentionally malicious, it contains many common mistakes like using unsafe memory functions and executing commands with user input. These issues look more like ordinary insecure coding than signs of a hidden attack, but they still need to be fixed before the project can be used safely. The developer should address these specific problems immediately to prevent potential security breaches in production environments.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 8 | 40 | 0 | 48 |
| yara | Signatures of malicious behaviour in source files | 5 | 0 | 7 | 12 |
35 of 60 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption. | 2 | /internal/allocator.c:52 |
| high | semgrep | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use | 1 | /.github/workflows/debug-bugfix.yml:60 |
| high | semgrep | Executing non-constant commands. This can lead to command injection. | 4 | /fuzzy-tests/_harness/Steps.php:2720 |
| high | semgrep | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. | 1 | /Dockerfile:105 |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 5 | /.github/workflows/debug-exec.yml |
| medium | semgrep | File name based on user input risks server-side request forgery. | 5 | /fuzzy-tests/_harness/freeze.php:77 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 27 | /.github/workflows/build-freebsd.yml:20 |
| medium | semgrep | Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). | 1 | /fuzzy-tests/_peers/forked_peer.php:23 |
| medium | semgrep | Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. | 7 | /fuzzy-tests/_harness/ChaosNet.php:348 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 7 | /Dockerfile |