MalDet

Scan report

shopware / shopware

Report Rescan
Vulnerability Safe

Could an attacker exploit mistakes in this code?

0 risk score

No issues of this kind were found.

High
0
Medium
0
Low
0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Medium

Does this code look like it is trying to cause harm?

35 risk score

Real issues worth reviewing before you rely on this code.

High
5
Medium
1
Low
3

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview
9 total findings
Likely real
7
Uncertain
0
Likely noise
2

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

This repository has been flagged as having a very low vulnerability risk score of 0, meaning there are no obvious coding errors that could be exploited by attackers right now. However, the code does show signs of malicious intent with a medium pattern score of 35, which suggests the developer may have intentionally included dangerous tools rather than accidentally leaving them in. The most concerning issues involve suspicious startup scripts and npm preinstall commands that are commonly used to deliver malware, along with evidence of base64-encoded payloads being executed directly. While some low-severity findings like reading environment variables or running processes silently could be accidental mistakes, the presence of these specific patterns strongly indicates that the code is not safe for general use without further review.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

  • GuardDog 7

    Supply-chain attack heuristics · Malicious pattern

  • YARA 2

    Malware signature rules · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.