MalDet · Static Security Report
The repository has two medium-risk scores, both indicating that there are some insecure coding patterns and signs of potentially malicious behavior, but these issues do not necessarily mean the code is intentionally harmful. The most critical finding is that the project uses Telnet to connect to remote servers, which is an extremely dangerous practice because it transmits data without encryption and can be easily exploited by attackers. Additionally, the code contains several other security concerns such as downloading files from the internet and executing them, along with potential memory scraping vulnerabilities, but these are likely due to standard development habits rather than deliberate attacks. While some of the flagged items appear in legitimate software like jQuery or Beowulf documentation, the presence of Telnet usage and the download-and-execute pattern suggests that this codebase requires immediate attention before it can be used safely.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| yara | Signatures of malicious behaviour in source files | 51 | 0 | 15 | 66 |
| bandit | Insecure coding patterns in Python source | 2 | 1 | 13 | 16 |
| guarddog | Malicious package and install-time behaviour | 3 | 0 | 1 | 4 |
6 of 86 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | guarddog | Detects HTTP/HTTPS URL dependencies in package.json (dependency confusion, untrusted sources) [threat-npm-http-dependency] | 3 | /web/skins/classic/js/jquery-ui-1.13.2/package.json:21 |
| high | bandit | Telnet-related functions are being called. Telnet is considered insecure. Use SSH or some other encrypted protocol. | 1 | /scripts/zmalarm-server.py:68 |
| high | bandit | A telnet-related module is being imported. Telnet is considered insecure. Use SSH or some other encrypted protocol. | 1 | /scripts/zmalarm-server.py:38 |
| high | yara | YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed | 4 | /web/js/hls-1.6.13/hls.min.js |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 1 | /web/includes/monitor_probe.php |
| high | yara | YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together | 39 | /web/skins/classic/assets/bootstrap-table/extensions/group-by-v2/bootstrap-table-group-by.js |
| high | yara | YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this | 7 | /distros/ubuntu2004/README.Debian |
| medium | bandit | Possible binding to all interfaces. | 1 | /scripts/zmalarm-server.py:118 |
| low | guarddog | Detects memory scraping and credential dumping from process memory [threat-process-memory] | 1 | /web/js/hls-1.6.13/hls.min.js:1 |
| low | bandit | Consider possible security implications associated with the subprocess module. | 4 | /scripts/zmalarm-server.py:62 |
| low | bandit | Starting a process with a partial executable path | 3 | /scripts/zmalarm-server.py:50 |
| low | bandit | subprocess call - check for execution of untrusted input. | 5 | /utils/check-shareddata-abi.py:80 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 15 | /dep/jwt-cpp/.github/actions/install/kazuho-picojson/action.yml |
| low | bandit | Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. | 1 | /tools/zm_stream_socket_dump.py:88 |