MalDet

Scan report

pass-culture / pass-culture-main

Report Rescan
Vulnerability Safe

Could an attacker exploit mistakes in this code?

0 risk score

No issues of this kind were found.

High
0
Medium
0
Low
0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Medium

Does this code look like it is trying to cause harm?

30 risk score

Real issues worth reviewing before you rely on this code.

High
7
Medium
0
Low
28

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview
35 total findings
Likely real
4
Uncertain
0
Likely noise
31

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

The repository has passed the most critical vulnerability check, scoring 0.0, which means there are no obvious insecure coding patterns that an attacker could exploit right now. However, it does show two other issues: one pattern is flagged as potentially malicious because it downloads and executes files from the internet, while another looks like a normal part of legitimate software development involving obfuscation techniques used to hide code. The YARA rules found in this scan are mostly false positives that happen to match common patterns in standard applications rather than indicating actual dangerous behavior. Overall, while the code is not currently vulnerable to known exploits, developers should be cautious about the specific file containing the download-and-execute pattern and treat the obfuscation as a normal feature of the project rather than a sign of hidden malware.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

  • YARA 31

    Malware signature rules · Malicious pattern

  • GuardDog 4

    Supply-chain attack heuristics · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.