Final Year Project · Development of an AI‑Driven Malware Detection and Trust Scoring System for GitHub Repositories (MalDet)
Know what a repository hides before you run it.
MalDet scans a public GitHub repository with six detection engines, sorts real issues from noise with a machine-learning classifier, and gives you two clear verdicts: is the code vulnerable, and does it look malicious?
One scan. Six engines. Two verdicts.
Running every tool by hand means reconciling six output formats and severity scales. MalDet does that work and reduces it to two numbers you can act on.
184
Repositories scanned
Every result is stored so you can compare a repository with its earlier scans.
63,522
Findings analysed
Each one is scored by the classifier for how likely it is to be a real issue.
Worst verdict per repository
- Safe23
- Low37
- Medium37
- High45
- Critical42
The project
A second opinion for
code you didn't write.
Developers clone, install and depend on public repositories every day, usually without reading them. Attackers know that and hide malware in packages, archives and install scripts. MalDet checks a repository for you before it reaches your machine.
Vulnerability verdict
Insecure coding patterns an attacker could exploit, such as injection, weak crypto or hard-coded secrets, plus known CVEs in the repository's pinned dependencies.
Malicious-pattern verdict
Signs that the code is meant to cause harm: malware signatures, obfuscated payloads, typosquatted package names and install-time hooks. It is scored separately, because a careless mistake and a deliberate attack are different risks.
Noise filtering with machine learning
Six engines on a large repository can produce tens of thousands of findings. A Random Forest classifier gives each finding a confidence that it is real, and that confidence weights the score instead of every alert counting the same.
Plain-English summary
A local language model explains the main findings in a short paragraph. It only explains the results. The risk levels are decided before it sees anything, and it may not change them.
How a scan runs
- 01FetchRepository metadata from the GitHub API, then a shallow clone.
- 02UnpackArchives are extracted, including password-protected ones.
- 03DetectSix engines inspect code, files and dependencies.
- 04TriageThe classifier separates likely-real findings from noise.
- 05ScoreTwo risk levels, from Safe to Critical, saved to your history.
Under the hood
The tools behind the verdict
Established open-source security tools, each looking for something different, plus two components built for this project.
Bandit
VulnerabilityFinds common security mistakes in Python code, such as shell injection, unsafe deserialisation and hard-coded passwords.
Semgrep
VulnerabilityPattern-based code analysis across many languages, using community security rules.
pip-audit
VulnerabilityChecks pinned Python dependencies against known CVE advisories, without installing or building anything.
YARA
Malicious patternMatches files against signature rules for malware families, droppers and obfuscated payloads.
ClamAV
Malicious patternOpen-source antivirus engine that scans every file, including ones inside extracted archives.
GuardDog
Malicious patternLooks for supply-chain attack behaviour: data exfiltration, install hooks and suspicious downloads.
Dependency checker
Malicious patternBuilt for MalDet. Flags typosquatted package names, direct-URL installs and unpinned versions.
Risk classifier
TriageBuilt for MalDet. A Random Forest model trained on real scan data that rates each finding's likelihood of being real.
Start here
Scan a repository
Paste a public GitHub link. Scans run one at a time on the server and usually take a few minutes. It is safe to close the tab and come back.
- Public repositories only
- Nothing from the repository is executed
- Results are saved to the history below
Scan history
Recently scanned
The ten most recent repositories, newest first.
| Repository | Language | Vulnerability | Malicious pattern | Scanned | Report |
|---|---|---|---|---|---|
| luzzast luzzast · 0 | Safe 0 | Safe 0 | 29 Oct 2026 | View | |
| maldet Skidotus · 1 | High 114 | Medium 17 | 29 Oct 2026 | View | |
| MalDet-Commercial-Website Mechaguy06 · 0 | Low 10 | Low 3 | 29 Oct 2026 | View | |
| anti-slop miqdadbadjuber · 7439 | Low 9 | Medium 20 | 28 Oct 2026 | View | |
| artcraft storytold · 22936 | Low 3 | Low 6 | 13 Oct 2026 | View | |
| gods-eye-view bilawalsidhu · 54046 | Safe 0 | High 63 | 13 Oct 2026 | View | |
| agent-router theagentrouter · 2192 | Medium 74 | Low 3 | 07 Oct 2026 | View | |
| core home-assistant · 91283 | Safe 0 | High 86 | 07 Oct 2026 | View | |
| nextcloud-mcp-server cbcoutinho · 376 | Critical 531 | Medium 21 | 07 Oct 2026 | View | |
| clawmetry vivekchand · 424 | Critical 584 | Critical 317 | 07 Oct 2026 | View |
About us
Built as a final year project, made to be used.
MalDet is a Final Year Project for the Diploma in Cyber Security Technology at the German-Malaysian Institute. It started from a simple question: how can a developer tell whether a public repository is safe to pull in without running six security tools and reading thousands of alerts?
The answer is to combine the tools, filter out the noise, and keep two kinds of risk separate, because they need different responses.
Project team
Ariff
Team member 1
Aleena
Team member 2
Adam
Team member 3
Supervisor
Sir Luqman
Project supervisor
Diploma in Cyber Security Technology · German-Malaysian Institute · 2026