MalDet

Scan report

sgl-project / sglang

Report Rescan
Vulnerability Critical

Could an attacker exploit mistakes in this code?

588 risk score

Strong warning signs. Do not run or install this without a careful review.

High
17
Medium
309
Low
8260

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Critical

Does this code look like it is trying to cause harm?

122 risk score

Strong warning signs. Do not run or install this without a careful review.

High
58
Medium
2
Low
83

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview
8,729 total findings
Likely real
259
Uncertain
155
Likely noise
8,315

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

This repository has been flagged as extremely dangerous by automated security tools, with a critical vulnerability score of 588.0 and a malicious-pattern score of 122.0, indicating that the code contains severe risks that could be exploited by attackers or signs of intentional harm. The most serious issues involve the use of dynamic code loading and downloading files from the internet to execute them at runtime, which allows an attacker to potentially run arbitrary malware if the code is shared publicly. Additionally, there are multiple instances where shell commands are started without proper validation, creating a high risk for command injection attacks that could allow attackers to execute system commands on your machine. While some findings relate to standard security practices like using deprecated functions or parsing untrusted XML data, these represent common insecure coding patterns rather than evidence of malicious intent. Because the code is hosted on GitHub and appears to be public, it should not be used in any production environment without a thorough review and complete removal of all identified dangerous components.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

  • Bandit 8,586

    Python security linter · Vulnerability

  • YARA 121

    Malware signature rules · Malicious pattern

  • GuardDog 22

    Supply-chain attack heuristics · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Large result: showing the top 343 of 8,729 findings (up to 200 per engine, most severe and most likely real first). Totals above include everything.