MalDet

Scan report

n1nj4sec / pupy

Report Rescan
Vulnerability Critical

Could an attacker exploit mistakes in this code?

1043 risk score

Strong warning signs. Do not run or install this without a careful review.

High
85
Medium
193
Low
142

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Critical

Does this code look like it is trying to cause harm?

226 risk score

Strong warning signs. Do not run or install this without a careful review.

High
27
Medium
58
Low
16

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview
521 total findings
Likely real
247
Uncertain
126
Likely noise
148

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

This repository has been flagged as extremely dangerous because it contains multiple critical vulnerabilities that could allow attackers to steal data, execute code, or destroy files on the server. The scan identified specific issues such as using shell commands with 'shell=True' which lets attackers run arbitrary system commands, and a deprecated library called pyCrypto that is no longer secure. These findings indicate that the code likely contains malicious intent rather than just poor security practices, as it uses suspicious techniques like downloading and executing remote files to hide its true purpose. While some issues are related to outdated libraries, the presence of these high-confidence threats means the project should not be used in any production environment without a complete rewrite by a security expert.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

  • Bandit 307

    Python security linter · Vulnerability

  • Semgrep 113

    Pattern-based code analysis · Vulnerability

  • Dependency checker 44

    CVEs, typosquats and risky installs · Supply chain

  • YARA 28

    Malware signature rules · Malicious pattern

  • GuardDog 27

    Supply-chain attack heuristics · Malicious pattern

  • ClamAV 2

    Antivirus engine · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Large result: showing the top 414 of 521 findings (up to 200 per engine, most severe and most likely real first). Totals above include everything.