Scan report
AdguardTeam / HostlistsRegistry
Could an attacker exploit mistakes in this code?
Real issues worth reviewing before you rely on this code.
- High
- 0
- Medium
- 40
- Low
- 1
Sources: Bandit, Semgrep, pip-audit
Does this code look like it is trying to cause harm?
Strong warning signs. Do not run or install this without a careful review.
- High
- 32
- Medium
- 1
- Low
- 14
Sources: YARA, ClamAV, GuardDog, dependency checker
- Likely real
- 5
- Uncertain
- 55
- Likely noise
- 28
The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.
What we found, in plain English
The repository has two major red flags that indicate serious problems rather than just standard coding mistakes. The most critical issue is a "Critical" score of 104.0, which means the code contains patterns that could be intentionally used to run malicious software or mining tools. This high risk comes from specific files like download-locales.mjs and filter_27.txt that show attempts to fetch and execute remote files, as well as evidence of cryptocurrency mining connections. While there are some lower-priority issues about outdated package versions and potential path traversal bugs, these do not seem to be the primary concern driving the overall danger level. The developer should treat this repository with extreme caution and avoid using it in any production environment until the malicious patterns are removed or replaced.
Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.
Detections by engine
Score over time
Overall score each time this repository was scanned.
Findings
Highest severity first. Select a finding to see the code and what it means.
-
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /scripts/translations/download-locales.mjs line 119
- Likely real
- Yes, 95% confidence
Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec]
const success = await downloadFile(locale, fileConfig.filename); if (!success) { logger.warn(`Skipping ${fileConfig.name} for ${locale} due to download error`); -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /scripts/translations/download-locales.mjs line 90
- Likely real
- Yes, 95% confidence
Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec]
*/ async function downloadFile(locale, filename) { try { const response = await axios.get(LOCALES_DOWNLOAD_URL, { -
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /filters/general/filter_49_HageziUltimate/filter.txt
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /assets/filter_44.txt
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /filters/general/filter_51_HageziPro++/filter.txt
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /assets/filter_49.txt
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /filters/security/filter_44_HageziThreatIntelligenceFeeds/filter.txt
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /assets/filter_27.txt
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /assets/filter_32.txt
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /assets/filter_48.txt
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /filters/general/filter_48_HageziMultiPro/filter.txt
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /filters/general/filter_27_OISD_Blocklist_Big/filter.txt
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /filters/general/filter_34_HageziMultiNormal/filter.txt
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /assets/filter_51.txt
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /assets/filter_34.txt
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /filters/security/filter_55_HageziBadwareHosterBlocklist/filter.txt
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /filters/general/filter_5_OISD_Blocklist_Small/filter.txt
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /assets/filter_5.txt
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /assets/filter_55.txt
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /filters/security/filter_44_HageziThreatIntelligenceFeeds/filter.txt
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /assets/filter_44.txt
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /assets/filter_34.txt
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /assets/filter_51.txt
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /filters/general/filter_34_HageziMultiNormal/filter.txt
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /filters/general/filter_48_HageziMultiPro/filter.txt
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /filters/general/filter_49_HageziUltimate/filter.txt
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /assets/filter_48.txt
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /assets/filter_32.txt
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /assets/filter_49.txt
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /filters/general/filter_51_HageziPro++/filter.txt
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /filters/general/filter_70_1Hosts_Xtra/filter.txt
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /assets/filter_70.txt
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /.yarnrc.yml line 1
- Likely real
- Yes, 96% confidence
This .yarnrc.yml does not set a minimal age gate or sets it too low. Newly published packages can be malicious or unstable. Add `npmMinimalAgeGate: "7d"` to wait 7 days before resolving newly published package versions. Added in: 4.10 Reference: https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate
nodeLinker: node-modules -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /.github/workflows/workflow.yml line 19
- Likely real
- Yes, 52% confidence
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
uses: actions/checkout@v6 -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /.github/workflows/workflow.yml line 24
- Likely real
- Yes, 52% confidence
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
uses: actions/setup-node@v6 -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hostlists-builder/index.js line 107
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
file: path.join(localeDir, 'tags.json'), -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /scripts/translations/prepare.js line 27
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const metaPath = path.join(dirPath, METADATA_FILE); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /scripts/translations/prepare.js line 26
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const dirPath = path.join(baseDir, dir); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /scripts/translations/prepare.js line 26
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const dirPath = path.join(baseDir, dir); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /scripts/services/get-services-content.js line 88
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const serviceFilePath = path.resolve(__dirname, folderPath, `${fileName}${YML_FILE_EXTENSION}`); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hostlists-builder/index.js line 44
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
if (fs.existsSync(path.join(dir, CONFIGURATION_FILE))) { -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hostlists-builder/index.js line 111
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
file: path.join(localeDir, 'filters.json'), -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hostlists-builder/index.js line 115
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
file: path.join(localeDir, 'groups.json'), -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hostlists-builder/index.js line 154
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const tagsMetadata = JSON.parse(await readFile(path.join(tagsDir, METADATA_FILE))); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hostlists-builder/index.js line 159
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const metadata = JSON.parse(await readFile(path.join(filterDir, METADATA_FILE))); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hostlists-builder/index.js line 165
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const revisionFile = path.join(filterDir, REVISION_FILE); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hostlists-builder/index.js line 211
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const filterFile = path.join(filterDir, 'filter.txt'); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hostlists-builder/index.js line 278
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const services = JSON.parse(await readFile(path.join(assetsDir, SERVICES_FILE))); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hostlists-builder/index.js line 296
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const servicesFile = path.join(assetsDir, SERVICES_FILE); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hostlists-builder/index.js line 299
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const groupsMetadata = JSON.parse(await readFile(path.join(groupsDir, METADATA_FILE))); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hostlists-builder/index.js line 306
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const filtersMetadataDevFile = path.join(assetsDir, FILTERS_METADATA_DEV_FILE); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hostlists-builder/index.js line 316
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const filtersMetadataAppsFile = path.join(assetsDir, FILTERS_METADATA_APPS_FILE); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hostlists-builder/index.js line 339
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const filtersAppsI18nFile = path.join(assetsDir, FILTERS_APPS_I18N_METADATA_FILE); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hostlists-builder/utils/io.js line 43
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const currentPath = path.join(baseDir, file); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hostlists-builder/utils/io.js line 43
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const currentPath = path.join(baseDir, file); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /scripts/services/add-localizations.js line 176
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const translationFilePath = path.join(localesFolder, directory, SERVICES_TRANSLATION_FILE); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /scripts/services/add-localizations.js line 176
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const translationFilePath = path.join(localesFolder, directory, SERVICES_TRANSLATION_FILE); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /scripts/services/get-services-content.js line 88
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const serviceFilePath = path.resolve(__dirname, folderPath, `${fileName}${YML_FILE_EXTENSION}`); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hostlists-builder/index.js line 210
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const assetsFilterFile = path.join(assetsDir, filterName); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /scripts/translations/upload-base-locale.mjs line 54
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const outputFile = path.resolve(TEMP_CONVERTED_DIR, file); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hostlists-builder/index.js line 69
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const configurationFile = path.join(filterDir, CONFIGURATION_FILE); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hostlists-builder/index.js line 210
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const assetsFilterFile = path.join(assetsDir, filterName); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hostlists-builder/index.js line 302
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const filtersMetadataFile = path.join(assetsDir, FILTERS_METADATA_FILE); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hostlists-builder/index.js line 325
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const filtersI18nFile = path.join(assetsDir, FILTERS_I18N_METADATA_FILE); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /scripts/services/restore-removed-services.js line 28
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
path.join(`${sourceDirPath}/${removedObject.id}${YML_FILE_EXTENSION}`), -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /scripts/translations/download-locales.mjs line 134
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const localeDir = path.join(LOCALES_DIR, destinationLocale); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /scripts/translations/download-locales.mjs line 148
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
await fs.copyFile(TEMP_CONVERTED_FILE, path.join(localeDir, fileConfig.name)); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /scripts/translations/download-locales.mjs line 159
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
await fs.copyFile(TEMP_CONVERTED_FILE, path.join(ptPTDir, fileConfig.name)); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /scripts/translations/prepare.js line 22
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
.filter(file => fs.statSync(path.join(baseDir, file)).isDirectory()); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /scripts/translations/prepare.js line 22
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
.filter(file => fs.statSync(path.join(baseDir, file)).isDirectory()); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /scripts/translations/upload-base-locale.mjs line 45
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
const localeFile = path.resolve(LOCALES_DIR, BASE_LOCALE, file); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /scripts/translations/download-locales.mjs line 148
- Likely real
- Uncertain, 37% confidence
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
await fs.copyFile(TEMP_CONVERTED_FILE, path.join(localeDir, fileConfig.name)); -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- package.json
- Likely real
- Probably noise, 14% confidence
Loose version constraint: 'md5^2.3.0' — attacker could push malicious update
md5:^2.3.0 -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /hostlists-builder/index.js line 225
- Likely real
- Uncertain, 33% confidence
Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.
console.error(`Failed to compile ${metadata.filterId}:`, ex); -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- package.json
- Likely real
- Probably noise, 2% confidence
Loose version constraint: 'form-data^4.0.0' — attacker could push malicious update
form-data:^4.0.0 -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- package.json
- Likely real
- Probably noise, 2% confidence
Loose version constraint: 'eslint-plugin-jsdoc^46.8.2' — attacker could push malicious update
eslint-plugin-jsdoc:^46.8.2 -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- package.json
- Likely real
- Probably noise, 2% confidence
Loose version constraint: 'eslint-plugin-import^2.28.1' — attacker could push malicious update
eslint-plugin-import:^2.28.1 -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- package.json
- Likely real
- Probably noise, 2% confidence
Loose version constraint: 'eslint-config-airbnb-base^15.0.0' — attacker could push malicious update
eslint-config-airbnb-base:^15.0.0 -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- package.json
- Likely real
- Probably noise, 2% confidence
Loose version constraint: 'eslint^8.49.0' — attacker could push malicious update
eslint:^8.49.0 -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- package.json
- Likely real
- Probably noise, 2% confidence
Loose version constraint: 'axios^1.6.0' — attacker could push malicious update
axios:^1.6.0 -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- package.json
- Likely real
- Probably noise, 2% confidence
Loose version constraint: 'zod^4.1.4' — attacker could push malicious update
zod:^4.1.4 -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- package.json
- Likely real
- Probably noise, 2% confidence
Loose version constraint: 'xmldom^0.6.0' — attacker could push malicious update
xmldom:^0.6.0 -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- package.json
- Likely real
- Probably noise, 2% confidence
Loose version constraint: 'simple-git^3.32.3' — attacker could push malicious update
simple-git:^3.32.3 -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- package.json
- Likely real
- Probably noise, 2% confidence
Loose version constraint: 'js-yaml^4.1.0' — attacker could push malicious update
js-yaml:^4.1.0 -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- package.json
- Likely real
- Probably noise, 2% confidence
Loose version constraint: 'dayjs^1.11.11' — attacker could push malicious update
dayjs:^1.11.11 -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- package.json
- Likely real
- Probably noise, 2% confidence
Loose version constraint: 'chalk^4.0.0' — attacker could push malicious update
chalk:^4.0.0 -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- package.json
- Likely real
- Probably noise, 2% confidence
Loose version constraint: '@adguard/hostlist-compiler^2.1.0' — attacker could push malicious update
@adguard/hostlist-compiler:^2.1.0 -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- package.json
- Likely real
- Probably noise, 2% confidence
Loose version constraint: 'semver^7.7.2' — attacker could push malicious update
semver:^7.7.2
No findings match these filters.