Scan report
civicrm / civicrm-core
Could an attacker exploit mistakes in this code?
No issues of this kind were found.
- High
- 0
- Medium
- 0
- Low
- 0
Sources: Bandit, Semgrep, pip-audit
Does this code look like it is trying to cause harm?
Minor issues. Worth a glance, unlikely to be urgent.
- High
- 5
- Medium
- 0
- Low
- 5
Sources: YARA, ClamAV, GuardDog, dependency checker
- Likely real
- 1
- Uncertain
- 0
- Likely noise
- 9
The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.
What we found, in plain English
1 finding likely need attention, 9 look like noise. Most notable: YARA rule matched: detect_download_and_execute — Downloads a remote resource AND execut... in /templates/CRM/Admin/Page/APIExplorer.js (1% confidence).
Detections by engine
Findings
Highest severity first. Select a finding to see the code and what it means.
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /templates/CRM/Admin/Page/APIExplorer.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /CRM/Core/Payment/FirstData.php
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /CRM/Core/Payment/Realex.php
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /CRM/Core/Payment/PayPalImpl.php
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /CRM/Utils/HttpClient.php
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- package.json
- Likely real
- Yes, 95% confidence
package.json has a 'postinstall' script that runs automatically on npm install — worth a manual look: bash tools/scripts/npm/postinstall.sh
bash tools/scripts/npm/postinstall.sh -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- package.json
- Likely real
- Probably noise, 2% confidence
Loose version constraint: 'bower^1.8.8' — attacker could push malicious update
bower:^1.8.8 -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- package.json
- Likely real
- Probably noise, 2% confidence
Loose version constraint: 'civicrm-cv^0.1.2' — attacker could push malicious update
civicrm-cv:^0.1.2 -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- package.json
- Likely real
- Probably noise, 2% confidence
Loose version constraint: 'karma^6.4.4' — attacker could push malicious update
karma:^6.4.4 -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- package.json
- Likely real
- Probably noise, 2% confidence
Loose version constraint: 'karma-ng-html2js-preprocessor^1.0.0' — attacker could push malicious update
karma-ng-html2js-preprocessor:^1.0.0
No findings match these filters.