Scan report
DataDog / datadog-agent
Could an attacker exploit mistakes in this code?
Serious issues. Review the high-severity findings before using it.
- High
- 13
- Medium
- 102
- Low
- 334
Sources: Bandit, Semgrep, pip-audit
Does this code look like it is trying to cause harm?
Strong warning signs. Do not run or install this without a careful review.
- High
- 51
- Medium
- 4
- Low
- 44
Sources: YARA, ClamAV, GuardDog, dependency checker
- Likely real
- 104
- Uncertain
- 29
- Likely noise
- 415
The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.
What we found, in plain English
104 findings likely need attention, 415 look like noise. Most notable: Detects suspicious autostart persistence mechanisms [threat-filesystem-autostart] in /tasks/agent.py (99% confidence).
Detections by engine
Score over time
Overall score each time this repository was scanned.
Findings
Highest severity first. Select a finding to see the code and what it means.
Large result: showing the top 299 of 548 findings (up to 200 per engine, most severe and most likely real first). Totals above include everything.
-
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /tasks/agent.py line 615
- Likely real
- Yes, 99% confidence
Detects suspicious autostart persistence mechanisms [threat-filesystem-autostart]
with tempfile.NamedTemporaryFile(mode='w') as dockerfile: dockerfile.write( f'''FROM ubuntu:latest AS src -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /tasks/kernel_matrix_testing/compiler.py line 440
- Likely real
- Yes, 99% confidence
Detects suspicious autostart persistence mechanisms [threat-filesystem-autostart]
self.exec( f"cp /root/.bashrc {self.compiler_home}/.bashrc && chown {self.compiler_uid}:{self.compiler_gid} {self.compiler_home}/.bashrc", user="root", ) -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /tasks/kernel_matrix_testing/compiler.py line 446
- Likely real
- Yes, 99% confidence
Detects suspicious autostart persistence mechanisms [threat-filesystem-autostart]
self.exec( f"echo export DD_CC=/opt/toolchains/{self.arch.gcc_arch}/bin/{self.arch.gcc_arch}-linux-gnu-gcc >> {self.compiler_home}/.bashrc", user=self.compiler_user, ) -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /tasks/omnibus.py line 734
- Likely real
- Yes, 98% confidence
Detects destructive operations (recursive deletion, wiping) [threat-filesystem-destruction]
'mkdir -p /omnibus-state/opt/datadog-agent && ' 'rm -rf /opt/datadog-agent && ' 'ln -sfn /omnibus-state/opt/datadog-agent /opt/datadog-agent && ' 'dda inv -- -e omnibus.build --base-dir=/omnibus --gem-path=/gems' -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /tasks/agent.py line 384
- Likely real
- Yes, 96% confidence
Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec]
@task def exec( ctx, subcommand, -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /tasks/agent.py line 494
- Likely real
- Yes, 95% confidence
Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec]
latest_release = semver.VersionInfo(0) tags = requests.get("https://registry.datadoghq.com/v2/agent/tags/list", timeout=10) for tag in tags.json()['tags']: if not semver.VersionInfo.isvalid(tag): -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /tasks/renovate.py line 533
- Likely real
- Yes, 95% confidence
Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec]
try: with urllib.request.urlopen(url, timeout=120) as resp: # noqa: S310 — URLs come from the source file we're checking hasher = hashlib.sha256() while chunk := resp.read(1 << 20): -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/coverage.py line 341
- Likely real
- Yes, 67% confidence
tarfile.extractall used without any validation. Please check and discard dangerous members.
340 with tarfile.open(f"{downloaded_archive}", "r:gz") as tgz: 341 tgz.extractall(path='.') 342 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kmt.py line 2519
- Likely real
- Yes, 66% confidence
tarfile.extractall used without any validation. Please check and discard dangerous members.
2518 job_folder.mkdir(parents=True, exist_ok=True) 2519 tar.extractall(dest_path / job_folder) 2520 time_msg += f", extracted in {time.time() - download_end_time} seconds" -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/junit_upload_core.py line 111
- Likely real
- Yes, 66% confidence
tarfile.extractall used without any validation. Please check and discard dangerous members.
110 with tarfile.open(junit_tgz) as tgz: 111 tgz.extractall(path=str(working_dir)) 112 # If archive contains folders, save them as we will put split xmls in folder on the working_dir -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/debugging/delve.py line 16
- Likely real
- Uncertain, 35% confidence
Starting a process with a shell, possible injection detected, security issue.
15 def __interactive_cmd(self, cmd): 16 os.system(f'{self.dlv_cmd} {cmd}') 17 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/debugging/dump.py line 338
- Likely real
- Uncertain, 35% confidence
Starting a process with a shell, possible injection detected, security issue.
337 with tempfile.TemporaryDirectory() as tmp_dir: 338 os.system(f'dpkg-deb --raw-extract {deb_path} {tmp_dir}') 339 # example: opt/datadog-agent/.debug/opt/datadog-agent/bin/agent/agent.dbg -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/debugging/dump.py line 375
- Likely real
- Uncertain, 35% confidence
Starting a process with a shell, possible injection detected, security issue.
374 debug_root = 'opt/datadog-agent/.debug' 375 os.system(f'rpm2cpio {rpm_path} | cpio -idm -D {tmp_dir}') 376 shutil.copytree(f"{tmp_dir}/{debug_root}", output_dir, dirs_exist_ok=True) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/debugging/windbg.py line 15
- Likely real
- Uncertain, 35% confidence
Starting a process with a shell, possible injection detected, security issue.
14 def open_dump(self, path: Path | str): 15 os.system(f'cmd.exe /c start {self.windbg_cmd} -z "{path}"') -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/go_mod_formatter_tests.py line 27
- Likely real
- Uncertain, 33% confidence
subprocess call with shell=True identified, security issue.
26 ) 27 p = subprocess.run(f"cp {src} {dest}", shell=True) 28 assert p.returncode == 0 -
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/libs/dynamic_test/jev/jev_client.py
- Likely real
- Uncertain, 33% confidence
YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/libs/dynamic_test/jev/pr_context.py
- Likely real
- Uncertain, 33% confidence
YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/libs/ciproviders/github_api.py
- Likely real
- Uncertain, 33% confidence
YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/libs/common/omnibus.py
- Likely real
- Uncertain, 33% confidence
YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/unit_tests/omnibus_tests.py
- Likely real
- Uncertain, 33% confidence
YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md
-
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/go_mod_formatter_tests.py line 15
- Likely real
- Uncertain, 32% confidence
subprocess call with shell=True identified, security issue.
14 f"go run ./internal/tools/modformatter/modformatter.go --path {path} --repoPath {repo_path} {extraArgs}", 15 shell=True, 16 capture_output=True, 17 ) 18 if not allow_fail: 19 assert proc.returncode == 0, f"\n{proc.stderr.decode('utf-8')}" 20 return proc.stdout -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/types/types.py line 25
- Likely real
- Uncertain, 32% confidence
subprocess call with shell=True identified, security issue.
24 [f"grep -Rl --include=\"*_test.go\" '{self.name}' '{self.package}'"], 25 shell=True, 26 stdout=subprocess.PIPE, 27 ) 28 return output.stdout.decode('utf-8').splitlines()[0] 29 except Exception as e: 30 print(f"Exception '{e}' while finding test {self.name} from package {self.package}.") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/go.py line 60
- Likely real
- Uncertain, 32% confidence
subprocess call with shell=True identified, security issue.
59 for attempt in range(max_retry): 60 result = subprocess.run(cmd, shell=True, cwd=path, capture_output=True, text=True) 61 if result.returncode == 0: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/static_quality_gates/experimental_gates.py line 863
- Likely real
- Uncertain, 32% confidence
subprocess call with shell=True identified, security issue.
862 ) 863 extract_result = subprocess.run(extract_command, shell=True, capture_output=True).returncode 864 if extract_result != 0: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/system_probe.py line 479
- Likely real
- Uncertain, 32% confidence
subprocess call with shell=True identified, security issue.
478 479 target_packages = [p.strip() for p in check_output(cmd, shell=True, encoding='utf-8').split("\n")] 480 return [p for p in target_packages if len(p) > 0] -
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /pkg/security/utils/proc_linux.go
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /pkg/fleet/installer/packages/datadog_agent_linux.go
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /pkg/gpu/cuda/testutil/testdata/heavy-sample
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /pkg/gpu/cuda/testutil/testdata/sample
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/kernel_matrix_testing/setup/common.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Dockerfiles/agent/Dockerfile
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/bpftool_downloader.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /.gitlab/.pre/deps_build/deps_build.yml
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /.gitlab/.pre/deps_fetch/deps_fetch.yml
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/kmt.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/unit_tests/e2e_internet_access_tests.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/e2e_framework/setup/pulumi.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/collector.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/agent.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/renovate.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/omnibus.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/install_tasks.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/libs/dynamic_test/jev/jev_client.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/libs/dynamic_test/jev/pr_context.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/gotest.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/unit_tests/bazel_remote_cache_tests.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /pkg/template/html/escape.go
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /pkg/template/html/html.go
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /comp/core/gui/impl/views/private/js/jquery-3.5.1.min.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /comp/core/gui/impl/views/private/js/codemirror.min.js
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /comp/core/gui/impl/systray/Sources/gui.swift
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/agent.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/kernel_matrix_testing/setup/linux_localvms.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/kernel_matrix_testing/compiler.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/unit_tests/gitlab_api_tests.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /.agents/skills/anomalydetection-run-gensim-scenario-on-vm/scripts/bootstrap.sh
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cmd/agent/macos/uninstall_mac_os.sh
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cmd/agent/macos/install_mac_os_v1.sh
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /omnibus/package-scripts/dogstatsd-rpm/posttrans
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /omnibus/package-scripts/iot-agent-rpm/posttrans
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /omnibus/package-scripts/dogstatsd-deb/postinst
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /omnibus/package-scripts/agent-dmg/preinst
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /omnibus/package-scripts/iot-agent-deb/postinst
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /omnibus/package-scripts/agent-dmg/postinst
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /pkg/ebpf/uprobes/telemetry.go line 41
- Likely real
- Yes, 98% confidence
Detects unicode homoglyphs and uncommon characters used for obfuscation [threat-runtime-obfuscation-unicode]
td.binaryInspectionBuckets = []float64{ 10e3, // 10μs 100e3, // 100μs 1e6, // 1ms -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /pkg/util/cloudproviders/alibaba/alibaba.go line 23
- Likely real
- Yes, 98% confidence
Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration]
var ( metadataURL = "http://100.100.100.200" timeout = 300 * time.Millisecond -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/go_deps.py line 574
- Likely real
- Yes, 98% confidence
Use of insecure and deprecated function (mktemp).
573 574 tmpfile = tempfile.mktemp(prefix="graph-") 575 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/package/url.py line 61
- Likely real
- Yes, 98% confidence
Use of insecure and deprecated function (mktemp).
60 61 filename = tempfile.mktemp() 62 primary_url = f"{packages_url}/{location.get('href')}" -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/e2e_framework/config.py line 166
- Likely real
- Yes, 98% confidence
Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load().
165 content = f.read() 166 config_dict = yaml.load(content, Loader=yaml.Loader) 167 return Config.model_validate(config_dict) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /bazel/rules/macos/pkg/build_mac_pkg.py line 31
- Likely real
- Yes, 97% confidence
Chmod setting a permissive mask 0o755 on file (dst).
30 shutil.copyfile(src, dst) 31 os.chmod(dst, 0o755) 32 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/bpftool_downloader.py line 143
- Likely real
- Yes, 97% confidence
Chmod setting a permissive mask 0o755 on file (bpftool_path).
142 # Make executable 143 os.chmod(bpftool_path, 0o755) 144 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/security_agent.py line 327
- Likely real
- Yes, 97% confidence
Chmod setting a permissive mask 0o755 on file (dst).
326 shutil.copy2(src, dst) 327 os.chmod(dst, 0o755) 328 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/gpu.py line 104
- Likely real
- Yes, 97% confidence
Call to requests with timeout set to None
103 try: 104 response = requests.get( 105 artifact_url, 106 headers={"Authorization": token}, 107 stream=True, 108 timeout=None, 109 ) 110 response.raise_for_status() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/system_probe.py line 1087
- Likely real
- Yes, 97% confidence
Chmod setting a permissive mask 0o755 on file (dst).
1086 shutil.copy2(src_bin, dst) 1087 os.chmod(dst, 0o755) 1088 else: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/system_probe.py line 1085
- Likely real
- Yes, 97% confidence
Chmod setting a permissive mask 0o755 on file (dst).
1084 if os.path.exists(dst): 1085 os.chmod(dst, 0o755) 1086 shutil.copy2(src_bin, dst) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/package/url.py line 92
- Likely real
- Yes, 97% confidence
Call to requests with timeout set to None
91 def _deb_get_filename_for_package(packages_url: str, target_package_name: str) -> str: 92 response = requests.get(packages_url, timeout=None) 93 response.raise_for_status() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/package/url.py line 52
- Likely real
- Yes, 97% confidence
Call to requests with timeout set to None
51 repomd_url = f"{packages_url}/repodata/repomd.xml" 52 response = requests.get(repomd_url, timeout=None) 53 response.raise_for_status() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/build/bazel.py line 287
- Likely real
- Yes, 97% confidence
Chmod setting a permissive mask 0o755 on file (bin_path).
286 shutil.copy2(src, bin_path) 287 os.chmod(bin_path, 0o755) 288 uid = os.environ.get("HOST_UID", "-1") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/collector.py line 216
- Likely real
- Yes, 97% confidence
Chmod setting a permissive mask 0o755 on file (binary_path).
215 urllib.request.urlretrieve(binary_url, binary_path) 216 os.chmod(binary_path, 0o755) 217 print(f"Downloaded to {binary_path}") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/coverage.py line 67
- Likely real
- Yes, 97% confidence
Chmod setting a permissive mask 0o755 on file (call_ps1_from_bat).
66 os.chmod(self.cov_test_path, 0o755) 67 os.chmod(self.call_ps1_from_bat, 0o755) 68 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/coverage.py line 66
- Likely real
- Yes, 97% confidence
Chmod setting a permissive mask 0o755 on file (cov_test_path).
65 66 os.chmod(self.cov_test_path, 0o755) 67 os.chmod(self.call_ps1_from_bat, 0o755) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/download.py line 11
- Likely real
- Yes, 97% confidence
Call to requests with timeout set to None
10 print(f"Downloading {url} to {path}") 11 response = requests.get(url, stream=True, timeout=None) 12 response.raise_for_status() -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cmd/cluster-agent/subcommands/start/command.go line 511
- Likely real
- Yes, 96% confidence
Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]
} if env := config.GetString("cluster_agent.tracing.env"); env != "" { opts = append(opts, tracer.WithEnv(env)) } -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cmd/security-agent/subcommands/start/command.go line 408
- Likely real
- Yes, 96% confidence
Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]
ProfilingURL: site, Env: config.GetString(secAgentKey("internal_profiling.env")), Service: "security-agent", Period: config.GetDuration(secAgentKey("internal_profiling.period")), -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/bazel.py line 211
- Likely real
- Yes, 56% confidence
Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
210 return 211 tree = ET.parse(xml_path) 212 root = tree.getroot() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/bazel.py line 251
- Likely real
- Yes, 56% confidence
Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
250 try: 251 file_root = ET.parse(xml_path).getroot() 252 except ET.ParseError: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/ci.py line 198
- Likely real
- Yes, 56% confidence
Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
197 if data is not None: 198 reports.append(ET.parse(data)) 199 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kmt.py line 2149
- Likely real
- Yes, 56% confidence
Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
2148 for file in vm_folder.glob("*.xml"): 2149 xml = ET.parse(file) 2150 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/junit_upload_core.py line 68
- Likely real
- Yes, 56% confidence
Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
67 """ 68 tree = ET.parse(xml_path) 69 root = tree.getroot() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/junit_upload_core.py line 180
- Likely real
- Yes, 56% confidence
Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
179 """ 180 tree = ET.parse(xml_path) 181 output_xmls = {} -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/package/url.py line 54
- Likely real
- Yes, 52% confidence
Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
53 response.raise_for_status() 54 repomd = ET.fromstring(response.text) 55 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/bazel_tests.py line 90
- Likely real
- Yes, 52% confidence
Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
89 # (diff_test, sh_test, rust tests, ...): one testcase, no classname. 90 suite = ET.fromstring('<testsuite tests="1"><testcase name="some_check" status="run"></testcase></testsuite>') 91 self.assertFalse(_is_gotestsum_shaped(suite)) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/bazel_tests.py line 79
- Likely real
- Yes, 52% confidence
Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
78 def test_true_when_every_testcase_has_classname(self): 79 suite = ET.fromstring( 80 '<testsuite tests="2">' 81 '<testcase name="TestFoo" classname="pkg/foo"></testcase>' 82 '<testcase name="TestBar" classname="pkg/foo"></testcase>' 83 "</testsuite>" 84 ) 85 self.assertTrue(_is_gotestsum_shaped(suite)) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/package/url.py line 67
- Likely real
- Yes, 52% confidence
Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
66 67 primary = ET.fromstring(res.stdout.strip()) 68 for package in primary.findall('.//{*}package'): -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/collector.py line 215
- Likely real
- Uncertain, 49% confidence
Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
214 try: 215 urllib.request.urlretrieve(binary_url, binary_path) 216 os.chmod(binary_path, 0o755) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/dynamic_test/jev/pr_context.py line 58
- Likely real
- Uncertain, 49% confidence
Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
57 try: 58 with urllib.request.urlopen(f"{DDCI_METADATA_URL}/{request_id}", timeout=15) as resp: 59 data = json.load(resp) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/python_version.py line 151
- Likely real
- Uncertain, 49% confidence
Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
150 req = urllib.request.Request(url) 151 with urllib.request.urlopen(req, timeout=timeout, context=ctx) as response: 152 return response.read().decode('utf-8') -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/renovate.py line 533
- Likely real
- Uncertain, 49% confidence
Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
532 try: 533 with urllib.request.urlopen(url, timeout=120) as resp: # noqa: S310 — URLs come from the source file we're checking 534 hasher = hashlib.sha256() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /deps/cacerts/update_cacerts.py line 29
- Likely real
- Uncertain, 48% confidence
Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
28 def _fetch(url): 29 with urllib.request.urlopen(url) as resp: 30 return resp.read().decode("utf-8") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/bpftool_downloader.py line 66
- Likely real
- Uncertain, 48% confidence
Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
65 try: 66 urllib.request.urlretrieve(url, dest) 67 return True -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/dynamic_test/jev/jev_client.py line 145
- Likely real
- Uncertain, 48% confidence
Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
144 try: 145 with urllib.request.urlopen(req, timeout=120) as resp: 146 return json.load(resp) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/omnibus.py line 214
- Likely real
- Uncertain, 48% confidence
Use of weak SHA1 hash for security. Consider usedforsecurity=False
213 print('Computing cache key') 214 h = hashlib.sha1() 215 _hash_paths( -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/renovate.py line 85
- Likely real
- Uncertain, 41% confidence
Use of possibly insecure function - consider using safer ast.literal_eval.
84 try: 85 namespace[name] = eval(expr, {"__builtins__": {}}, namespace) # noqa: S307 — restricted namespace, preamble-only expressions 86 except Exception: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/renovate.py line 476
- Likely real
- Uncertain, 41% confidence
Use of possibly insecure function - consider using safer ast.literal_eval.
475 try: 476 result = eval(expr, {"__builtins__": {}}, namespace) # noqa: S307 — namespace is preamble-only scalars 477 except Exception: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/new_e2e_tests.py line 182
- Likely real
- Uncertain, 40% confidence
Use of exec detected.
181 test_binaries_bzl = {} 182 exec((repo_root / "test/new-e2e/tests/test_binaries.bzl").read_text(), test_binaries_bzl) 183 test_binaries = test_binaries_bzl["TEST_BINARIES"] -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /bazel/rules/go/gen_tags_go.py line 27
- Likely real
- Uncertain, 40% confidence
Use of exec detected.
26 with open(bzl_path) as src: 27 exec(src.read(), namespace) # noqa: S102 - build_tags.bzl is trusted, valid Python 28 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/custom_task/custom_task.py line 23
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
22 WIN_TEMP_FOLDER = "C:\\Windows\\Temp" 23 UNIX_TEMP_FOLDER = "/tmp" 24 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/vmconfig.py line 802
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
801 802 tmpfile = "/tmp/vm.json" 803 with open(tmpfile, "w") as f: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/common/worktree_tests.py line 13
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
12 13 TEST_WORKTREE_DIR = Path('/tmp/datadog-agent-worktree') 14 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/notify/failure_summary_tests.py line 16
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
15 16 TEST_DIR = '/tmp/summary' 17 ALL_TEAMS_CHANNEL = '#channel-broadcast' -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/gdb.py line 46
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
45 self.target.copy( 46 ctx, get_repo_root() / "tasks/kernel_matrix_testing/provision/ubuntu-dbg.sh", "/tmp/provision.sh" 47 ) 48 self.target.run_cmd(ctx, "chmod +x /tmp/provision.sh && /tmp/provision.sh") 49 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/url_tests.py line 90
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
89 # Mock tempfile.mktemp 90 mock_mktemp.return_value = "/tmp/fake_temp_file" 91 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/compiler.py line 30
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
29 CONTAINER_AGENT_PATH = "/tmp/datadog-agent" 30 MARKER_IMAGE_PREPARED = "/tmp/kmt-image-prepared" 31 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/compiler.py line 29
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
28 29 CONTAINER_AGENT_PATH = "/tmp/datadog-agent" 30 MARKER_IMAGE_PREPARED = "/tmp/kmt-image-prepared" -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/ebpf.py line 775
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
774 common_ancestor = get_common_ancestor(ctx, commit_sha, base_branch_ref) 775 main_branch_complexity_path = Path("/tmp/verifier-complexity-main") 776 print(f"Downloading complexity data for {base_branch} branch (commit {common_ancestor})...") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/e2e_framework/test.py line 53
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
52 "nvram": "/tmp/nvram", 53 "efi": "/tmp/efi", 54 "vcpu": "4", 55 "cputune": "<cputune></cputune>", 56 "hypervisor": "hvf", 57 "commandLine": "<arg value=\"test\"/>", 58 } 59 60 for repl in replacements or []: 61 key, value = repl.split("=") 62 default_replacements[key] = value 63 64 with open(xslt) as f: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/e2e_framework/test.py line 52
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
51 "mac": "52:54:00:00:00:00", 52 "nvram": "/tmp/nvram", 53 "efi": "/tmp/efi", 54 "vcpu": "4", 55 "cputune": "<cputune></cputune>", 56 "hypervisor": "hvf", 57 "commandLine": "<arg value=\"test\"/>", 58 } 59 60 for repl in replacements or []: 61 key, value = repl.split("=") 62 default_replacements[key] = value 63 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 2571
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
2570 workspace_name: str, 2571 output_dir: str = "/tmp/observer-pipeline-eval", 2572 local_dir: str = "", 2573 only_report: bool = False, 2574 ): 2575 """ 2576 After ``anomalydetection.eval-pipeline`` on a remote dev workspace, copy results to your machine. -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 2507
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
2506 workspace_name: str, 2507 output_dir: str = "/tmp/observer-component-eval", 2508 local_dir: str = "", 2509 only_report: bool = False, 2510 ): 2511 """ 2512 After ``anomalydetection.eval-component`` on a remote dev workspace, copy results to your machine. -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 2216
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
2215 m_runs: int = 1, 2216 output_dir: str = "/tmp/observer-component-eval", 2217 scenarios_dir: str = "./comp/anomalydetection/observer/scenarios", 2218 sigma: float = 30.0, 2219 seed: int = None, 2220 build: bool = True, 2221 overwrite: bool = False, 2222 tune_evaluated_component: bool = False, 2223 enable: str = "", 2224 disable: str = "", 2225 lock: str = "", 2226 timeout: int = 300, 2227 scenarios: str = "", 2228 ): 2229 """ 2230 Evaluate whether adding a component improves observer accuracy via Bayesian optimization. 2231 2232 For N random subsets of detectors/correlators: 2233 - Run M independent Bayesian optimizations WITHOUT the target component. -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 1840
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
1839 m_runs: int = 1, 1840 output_dir: str = "/tmp/observer-pipeline-eval", 1841 scenarios_dir: str = "./comp/anomalydetection/observer/scenarios", 1842 sigma: float = 30.0, 1843 seed: int = None, 1844 build: bool = True, 1845 overwrite: bool = False, 1846 resume: bool = False, 1847 force_enable: str = "", 1848 force_disable: str = "", 1849 timeout: int = 0, 1850 scenarios: str = "", 1851 eval_backend: str = "local", 1852 ddeval_config_template: str = "", 1853 ddeval_ddsource_dir: str = "", 1854 ddeval_command: str = "", 1855 ddeval_service: str = "eval_worker_observer_log_ad", 1856 ddeval_project: str = "observer-log-ad", 1857 ddeval_dataset: str = "observer-log-ad-gensim-store-working", 1858 ddeval_env: str = "staging", 1859 ddeval_test_drive: str = "observer-log-ad-ddeval-worker", 1860 ddeval_jobs: int = 6, 1861 ddeval_max_attempts: int = 1, 1862 ddeval_limit: int = 0, 1863 ddeval_where_in: str = "", 1864 ddeval_testbench_binary_s3_uri: str = "", 1865 ddeval_scorer_binary_s3_uri: str = "", 1866 ): 1867 """ 1868 Full pipeline fine-tuning: Bayesian search over component combinations, then deep tuning on the winner. 1869 1870 Step 1 — Search: for each of n_combos combinations (full stack + anchor subsets + random), 1871 run Bayesian HP optimisation with n_trials_search trials. The combination with the -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 1147
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
1146 n_trials: int = 10, 1147 output_dir: str = "/tmp/observer-optuna-eval", 1148 scenarios_dir: str = "./comp/anomalydetection/observer/scenarios", 1149 sigma: float = 30.0, 1150 seed: int = None, 1151 build: bool = True, 1152 overwrite: bool = False, 1153 timeout: int = 0, 1154 scenarios: str = "", 1155 eval_backend: str = "local", 1156 ddeval_config_template: str = "", 1157 ddeval_ddsource_dir: str = "", 1158 ddeval_command: str = "", 1159 ddeval_service: str = "eval_worker_observer_log_ad", 1160 ddeval_project: str = "observer-log-ad", 1161 ddeval_dataset: str = "observer-log-ad-gensim-store-working", 1162 ddeval_env: str = "staging", 1163 ddeval_test_drive: str = "observer-log-ad-ddeval-worker", 1164 ddeval_jobs: int = 6, 1165 ddeval_max_attempts: int = 1, 1166 ddeval_limit: int = 0, 1167 ddeval_where_in: str = "", 1168 ddeval_testbench_binary_s3_uri: str = "", 1169 ddeval_scorer_binary_s3_uri: str = "", 1170 _logger: StepLogger | None = None, 1171 ): 1172 """ 1173 Run Bayesian hyperparameter optimization (Optuna TPE) for a fixed set of observer components. 1174 1175 Each trial enables the specified components, sampling hyperparameters and scoring via 1176 eval_scenarios (mean F1). Locked components (--lock) are enabled but use Go defaults (not tuned). -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 762
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
761 n: int = 10, 762 output_dir: str = "/tmp/observer-eval-combinations", 763 scenarios_dir: str = "./comp/anomalydetection/observer/scenarios", 764 sigma: float = 30.0, 765 seed: int = None, 766 build: bool = True, 767 overwrite: bool = False, 768 force_enable: str = "", 769 force_disable: str = "", 770 scenarios: str = "", 771 ): 772 """ 773 Run Gaussian F1 eval on n component combinations and rank them. -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 718
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
717 718 output_path = f"/tmp/observer-eval-{name}-tp.json" 719 print(color_message(f"\n{'=' * 60}", Color.BLUE)) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 514
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
513 config: str = "", 514 scenario_output_dir: str = "/tmp", 515 timeout: int = 0, 516 scenarios: str = "", 517 _logger: StepLogger | None = None, 518 ) -> dict: 519 """ 520 Runs the observer F1 eval: replays scenarios, scores Gaussian F1. 521 522 The main score is a metric between 0 and 1, 1 being the best. This is the 523 source of truth for anomaly detection accuracy. 524 525 Uses testbench --only to control which components are active. 526 Default (no --only): uses testbench defaults (bocpd and -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 512
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
511 build: bool = True, 512 main_report_path: str = "/tmp/observer-eval-main-report.json", 513 config: str = "", 514 scenario_output_dir: str = "/tmp", 515 timeout: int = 0, 516 scenarios: str = "", 517 _logger: StepLogger | None = None, 518 ) -> dict: 519 """ 520 Runs the observer F1 eval: replays scenarios, scores Gaussian F1. 521 522 The main score is a metric between 0 and 1, 1 being the best. This is the 523 source of truth for anomaly detection accuracy. 524 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 191
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
190 if not cpu_profile_path: 191 cpu_profile_path = f"/tmp/anomalydetection-testbench-headless-{headless_scenario}.cpu.prof" 192 flags += f" --cpuprofile {shlex.quote(cpu_profile_path)}" -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 187
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
186 if not mem_profile_path: 187 mem_profile_path = f"/tmp/anomalydetection-testbench-headless-{headless_scenario}.mem.prof" 188 flags += f" --memprofile {shlex.quote(mem_profile_path)}" -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/anomalydetection.py line 184
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
183 if not headless_output: 184 headless_output = f"/tmp/anomalydetection-testbench-headless-{headless_scenario}.json" 185 if mem_profile: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/ai_sandbox.py line 64
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
63 stack_name="ai-sandbox", 64 remote_output_dir="/tmp/ai-sandbox-output", 65 local_output_dir="./ai-sandbox-output", 66 keep=False, 67 ): 68 """ 69 Provision an AWS host (agent installed), run claude/codex on it, and retrieve a directory. 70 71 Example: 72 dda inv ai-sandbox.run --tool=claude --model=claude-opus-4-8 \\ 73 --prompt="Summarize the agent status into /tmp/ai-sandbox-output/summary.txt" \\ 74 --remote-output-dir=/tmp/ai-sandbox-output --local-output-dir=./out 75 """ 76 if tool not in ("claude", "codex"): 77 raise Exit(message=f"unknown --tool {tool!r} (expected claude or codex)", code=1) 78 if not prompt and not prompt_file: 79 raise Exit(message="one of --prompt or --prompt-file is required", code=1) 80 if prompt and prompt_file: 81 raise Exit(message="--prompt and --prompt-file are mutually exclusive", code=1) 82 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /omnibus/python-scripts/packages_tests.py line 118
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
117 with self.assertRaises(IntegrationInstallError) as ctx: 118 install_datadog_package('datadog-ping==1.0.2', '/tmp/agent') 119 self.assertEqual(mock_cmd.call_count, 2) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /omnibus/python-scripts/packages_tests.py line 110
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
109 with patch('packages.run_command', side_effect=[('', 'err', 1), ('', '', 0)]) as mock_cmd: 110 install_datadog_package('datadog-ping==1.0.2', '/tmp/agent') 111 self.assertEqual(mock_cmd.call_count, 2) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /omnibus/python-scripts/packages_tests.py line 103
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
102 with patch('packages.run_command', return_value=('', '', 0)) as mock_cmd: 103 install_datadog_package('datadog-ping==1.0.2', '/tmp/agent') 104 mock_cmd.assert_called_once() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/bpftool_downloader.py line 87
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
86 87 def download_bpftool(install_dir: str = "/tmp") -> Optional[str]: 88 """ -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kmt.py line 387
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
386 for domain in infra[arch].microvms: 387 domain.copy(ctx, provision_script, "/tmp/provision.sh") 388 domain.run_cmd(ctx, "chmod +x /tmp/provision.sh && /tmp/provision.sh", verbose=True) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/url_tests.py line 225
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
224 # Mock tempfile.mktemp 225 mock_mktemp.return_value = "/tmp/fake_temp_file" 226 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/url_tests.py line 24
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
23 # Mock tempfile.mktemp 24 mock_mktemp.return_value = "/tmp/fake_temp_file" 25 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/setup_env_tests.py line 110
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
109 @unittest.skipUnless(os.name == 'posix', "POSIX-only test") 110 @patch('os.path.abspath', return_value='/tmp/agent.msi') 111 def test_unix_path(self, _mock_abspath): -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/setup_env_tests.py line 112
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
111 def test_unix_path(self, _mock_abspath): 112 result = _path_to_file_url('/tmp/agent.msi') 113 self.assertEqual(result, "file:///tmp/agent.msi") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/common/go_tests.py line 94
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
93 94 result = go_build(self.ctx_mock, "main.go", bin_path="/tmp/test_binary") 95 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/common/go_tests.py line 72
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
71 self.assertEqual(result.exited, 0) 72 mock_exists.assert_called_once_with("/tmp/test_binary") 73 mock_chown.assert_not_called() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/common/go_tests.py line 69
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
68 69 result = go_build(self.ctx_mock, "main.go", bin_path="/tmp/test_binary") 70 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/common/go_tests.py line 59
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
58 self.assertEqual(result.exited, 0) 59 mock_exists.assert_called_once_with("/tmp/test_binary") 60 mock_chown.assert_not_called() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/common/go_tests.py line 56
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
55 56 result = go_build(self.ctx_mock, "main.go", bin_path="/tmp/test_binary") 57 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/common/go_tests.py line 47
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
46 mock_exists.assert_called_once_with("/tmp/test_binary") 47 mock_chown.assert_called_once_with("/tmp/test_binary", 1000, 1001) 48 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/common/go_tests.py line 46
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
45 self.assertEqual(result.exited, 0) 46 mock_exists.assert_called_once_with("/tmp/test_binary") 47 mock_chown.assert_called_once_with("/tmp/test_binary", 1000, 1001) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/common/go_tests.py line 43
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
42 43 result = go_build(self.ctx_mock, "main.go", bin_path="/tmp/test_binary") 44 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/e2e_framework_tool_tests.py line 95
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
94 # Empty is a valid passphrase, so presence -- not truthiness -- is what counts. 95 for ambient in ({"PULUMI_CONFIG_PASSPHRASE": ""}, {"PULUMI_CONFIG_PASSPHRASE_FILE": "/tmp/pass"}): 96 with self.subTest(ambient=ambient), mock.patch.dict("os.environ", ambient, clear=True): -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/e2e_framework_tool_tests.py line 47
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
46 ctx = _run_mock() 47 tool.run_pulumi(ctx, "version", project_dir="/tmp/a dir") 48 self.assertEqual(_command(ctx), "pulumi -C '/tmp/a dir' version") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/custom_task/custom_task_tests.py line 106
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
105 log_invoke_task( 106 log_path="/tmp/dd_invoke.log", 107 name="tname", -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/bazel_tests.py line 56
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
55 [ 56 Path("/tmp/test.xml"), 57 Path("/exec/root/bazel-out/k8-fastbuild/testlogs/pkg/foo/bar_test/test.xml"), -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/bazel_tests.py line 31
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
30 paths = _test_output_candidates("//pkg/foo:bar_test", "file:///tmp/test.xml", "cfg1", None, {}, "test.xml") 31 self.assertEqual(paths, [Path("/tmp/test.xml")]) 32 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/anomalydetection_eval_tests.py line 134
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
133 self.evaluation_inputs = _bayesian_evaluation_inputs( 134 scenarios_dir="/tmp/scenarios", 135 sigma=30.0, -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/anomalydetection_ddeval_tests.py line 165
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
164 dataset_version=6, 165 config_path="/tmp/config.json", 166 jobs=20, -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/anomalydetection_ddeval_tests.py line 41
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
40 with self.assertRaisesRegex(Exit, "custom --testbench-binary requires --no-build"): 41 eval_ddeval.body(None, testbench_binary="/tmp/custom-testbench") 42 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/package/size.py line 71
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
70 def extract_rpm_package(ctx, package_path, extract_dir): 71 log_dir = os.environ.get("CI_PROJECT_DIR", "/tmp") 72 out = ctx.run( -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/notify/failure_summary.py line 32
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
31 FAILURE_SUMMARY_S3_BUCKET_URL = f"s3://{FAILURE_SUMMARY_S3_BUCKET}/{FAILURE_SUMMARY_S3_PREFIX}" 32 FAILURE_SUMMARY_TMP_FILE = "/tmp/failure_summary.json" 33 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kmt.py line 2048
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
2047 boot_log_savepath = ( 2048 Path("/tmp") 2049 / f"kmt-pipeline-{pipeline}" -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kmt.py line 1392
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
1391 tmp.flush() 1392 remote_tmp = "/tmp" 1393 remote_run_config = os.path.join(remote_tmp, os.path.basename(tmp.name)) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/infra.py line 33
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
32 "ControlPersist": "10m", 33 "ControlPath": "/tmp/ssh_mux_%h_%p_%r", 34 } 35 36 37 def ssh_options_command(extra_opts: dict[str, str] | None = None): 38 opts = SSH_OPTIONS.copy() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/release_tests.py line 32
- Likely real
- Probably noise, 24% confidence
Probable insecure usage of temp file/directory.
31 32 MOCK_TMP_DIR = '/tmp/tmp' 33 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/cluster_agent.py line 214
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
213 latest_release = semver.VersionInfo(0) 214 tags = requests.get("https://registry.datadoghq.com/v2/cluster-agent/tags/list") 215 for tag in tags.json()['tags']: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/gotest.py line 1529
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
1528 upstream_pattern = r"^go (1(?:\.\d+){1,2})[\r]?$" 1529 r = requests.get(OTEL_UPSTREAM_GO_MOD_PATH) 1530 upstream_matches = re.findall(upstream_pattern, r.text, flags=re.MULTILINE) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/download.py line 33
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
32 sum_url = os.path.join(url_base, branch, get_sum_file(image)) 33 r = requests.get(sum_url) 34 if not r.ok: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/vmconfig.py line 933
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
932 try: 933 r = requests.get(sum_url) 934 r.raise_for_status() # Raise an exception for bad status codes -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/omnibus.py line 358
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
357 } 358 r = requests.post("https://api.datadoghq.com/api/v1/events", json=payload, headers=headers) 359 if not r.ok: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/utils.py line 692
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
691 try: 692 with requests.get(url, stream=True) as r: 693 r.raise_for_status() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/licenses.py line 217
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
216 try: 217 resp = requests.get(url.geturl()) 218 resp.raise_for_status() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/system_probe.py line 1637
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
1636 # only download images not present in preprepared vm disk 1637 resp = requests.get(u) 1638 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/collector.py line 492
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
491 try: 492 response = requests.get(url) 493 response.raise_for_status() # Raises an HTTPError if the HTTP request returned an unsuccessful status code -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/bazel_remote_cache_tests.py line 122
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'deadbeef'
121 self.assertEqual( 122 self._run(policy="auto", curl=0, vault=False, extra_env={"BUILDBARN_ID_TOKEN": "deadbeef"}), 123 "--config=cache", -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/e2e_framework_tool_tests.py line 91
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'from-config'
90 env = tool.pulumi_env() 91 self.assertEqual(env, {"PULUMI_SKIP_UPDATE_CHECK": "true", "PULUMI_CONFIG_PASSPHRASE": "from-config"}) 92 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/e2e_framework_tool_tests.py line 111
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'explicit'
110 env = tool.pulumi_env( 111 overrides={"PULUMI_CONFIG_PASSPHRASE": "explicit", "PULUMI_K8S_DELETE_UNREACHABLE": "true"} 112 ) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/github_tasks_tests.py line 523
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'coucou'
522 523 @patch.dict('os.environ', {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'coucou'}) 524 @patch('slack_sdk.WebClient', autospec=True) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/github_tasks_tests.py line 567
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'coucou'
566 567 @patch.dict('os.environ', {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'coucou'}) 568 @patch('slack_sdk.WebClient', autospec=True) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/github_tasks_tests.py line 625
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'coucou'
624 625 @patch.dict('os.environ', {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'coucou'}) 626 @patch('slack_sdk.WebClient', autospec=True) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/kmt_tests.py line 119
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'from-env'
118 def test_env_token_is_dropped_when_host_opts_out(self): 119 os.environ["BUILDBARN_ID_TOKEN"] = "from-env" 120 self.wants_cache.return_value = False -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/dynamic_test/jev_tools_tests.py line 75
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'fake'
74 ) 75 with patch.dict("os.environ", {"GITHUB_TOKEN": "fake"}, clear=True): 76 info = fetch_pr_info("main", None) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/release_tests.py line 532
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'slock'
531 ) 532 @patch.dict(os.environ, {'GITLAB_CI': 'true', 'GITHUB_ACTIONS': 'true', 'SLACK_DATADOG_AGENT_BOT_TOKEN': 'slock'}) 533 @patch('os.chdir', new=MagicMock()) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/release_tests.py line 717
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'sluck'
716 ) 717 @patch.dict(os.environ, {'GITLAB_CI': 'true', 'GITHUB_ACTIONS': 'true', 'SLACK_DATADOG_AGENT_BOT_TOKEN': 'sluck'}) 718 @patch('os.chdir', new=MagicMock()) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/e2e_framework/tool.py line 187
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'ci.datadog-agent.pulumi_password'
186 CI_PULUMI_BACKEND_URL = "s3://dd-pulumi-state" 187 CI_PULUMI_PASSPHRASE_SSM_PARAM = "ci.datadog-agent.pulumi_password" 188 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/compiler.py line 49
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'probe'
48 warn=True, 49 env={"BUILDBARN_ID_TOKEN": "probe"}, 50 ), -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/bazel_remote_cache_tests.py line 141
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'deadbeef'
140 container=True, 141 extra_env={"BUILDBARN_ID_TOKEN": "deadbeef"}, 142 ), -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/github_tasks_tests.py line 479
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'coucou'
478 class TestCheckPermissions(unittest.TestCase): 479 @patch.dict('os.environ', {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'coucou'}) 480 @patch('slack_sdk.WebClient', autospec=True) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/pipeline_tests.py line 36
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'zidane'
35 self.gh = MagicMock() 36 self.gh._auth.token = "zidane" 37 self.commits = MagicMock() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/devcontainer.py line 171
- Likely real
- Yes, 95% confidence
Possible hardcoded password: '${localEnv:GITHUB_TOKEN}'
170 devcontainer["containerEnv"] = { 171 "GITHUB_TOKEN": "${localEnv:GITHUB_TOKEN}", 172 "GITLAB_TOKEN": "${localEnv:GITLAB_TOKEN}", 173 } 174 175 configure_skaffold(devcontainer, SkaffoldProfile(skaffoldProfile)) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/devcontainer.py line 172
- Likely real
- Yes, 95% confidence
Possible hardcoded password: '${localEnv:GITLAB_TOKEN}'
171 "GITHUB_TOKEN": "${localEnv:GITHUB_TOKEN}", 172 "GITLAB_TOKEN": "${localEnv:GITLAB_TOKEN}", 173 } 174 175 configure_skaffold(devcontainer, SkaffoldProfile(skaffoldProfile)) 176 configure_claude_code(devcontainer, claude_code) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/notify/alerts_tests.py line 232
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'coucou'
231 @patch('slack_sdk.WebClient', autospec=True) 232 @patch.dict('os.environ', {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'coucou'}) 233 @patch.object(alerts.ConsecutiveJobAlert, 'message', lambda self, _: '\n'.join(self.failures) + '\n') -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/notify/alerts_tests.py line 296
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'coucou'
295 @patch('slack_sdk.WebClient', autospec=True) 296 @patch.dict('os.environ', {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'coucou'}) 297 @patch.object(alerts.ConsecutiveJobAlert, 'message', lambda self, _: '\n'.join(self.failures) + '\n') -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/release_tests.py line 599
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'slick'
598 @patch('os.chdir', new=MagicMock()) 599 @patch.dict(os.environ, {'GITLAB_CI': 'false', 'GITHUB_ACTIONS': 'false', 'SLACK_DATADOG_AGENT_BOT_TOKEN': 'slick'}) 600 def test_changes_new_commit_all_repo(self, version_mock, print_mock, _, web_mock): -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/invoke_unit_tests.py line 14
- Likely real
- Yes, 95% confidence
Possible hardcoded password: '618'
13 'CI_PIPELINE_ID': '42', 14 'CI_JOB_TOKEN': '618', 15 'CI_PROJECT_DIR': '.', 16 } 17 18 19 @task(default=True) 20 def run(ctx, tests: str = '', buffer: bool = True, verbosity: int = 1, debug: bool = True, directory: str = '.'): 21 """ 22 Run the unit tests on the invoke tasks 23 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/dynamic_test/jev_tools_tests.py line 52
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'tool --name "two words"'
51 with patch.dict("os.environ", {}, clear=True): 52 self.assertEqual(get_ai_gateway_token(token_cmd='tool --name "two words"'), "token") 53 run.assert_called_once_with(["tool", "--name", "two words"], capture_output=True, text=True, timeout=60) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/stacks.py line 257
- Likely real
- Yes, 95% confidence
Possible hardcoded password: '1234'
256 env = { 257 "PULUMI_CONFIG_PASSPHRASE": "1234", 258 "LibvirtSSHKeyX86": f"{stack_dir}/libvirt_rsa-x86_64", 259 "LibvirtSSHKeyARM": f"{stack_dir}/libvirt_rsa-arm64", 260 "CI_PROJECT_DIR": stack_dir, 261 } 262 263 vm_config = f"{stack_dir}/{VMCONFIG}" -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/kmt_tests.py line 114
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'from-env'
113 def test_env_token_is_used_without_vault(self): 114 os.environ["BUILDBARN_ID_TOKEN"] = "from-env" 115 self.assertEqual(compiler.get_buildbarn_token(self.ctx), "from-env") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/dynamic_test/jev_tools_tests.py line 61
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'override'
60 # The explicit token override short-circuits before it 61 self.assertEqual(get_ai_gateway_token(token="override"), "override") 62 run.assert_called_once_with( -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/dynamic_test/jev_tools_tests.py line 90
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'fake'
89 github_api.return_value.get_pr_for_branch.return_value = iter([]) 90 with patch.dict("os.environ", {"GITHUB_TOKEN": "fake"}): 91 info = fetch_pr_info("main", None) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/stacks.py line 220
- Likely real
- Yes, 95% confidence
Possible hardcoded password: '1234'
219 "TEAM": "ebpf-platform", 220 "PULUMI_CONFIG_PASSPHRASE": "1234", 221 "LibvirtSSHKeyX86": f"{stack_dir}/libvirt_rsa-x86_64", 222 "LibvirtSSHKeyARM": f"{stack_dir}/libvirt_rsa-arm64", 223 "CI_PROJECT_DIR": stack_dir, 224 } 225 226 provision_instance = remote_vms_in_config(vm_config) 227 local = local_vms_in_config(vm_config) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/omnibus.py line 100
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'Used to sign packages'
99 'RPM_GPG_KEY_NAME': 'Used to sign packages', 100 'RPM_SIGNING_PASSPHRASE': 'Used to sign packages', 101 }, 102 'darwin': { 103 'AWS_SHARED_CREDENTIALS_FILE': 'Path to the CI Identities-populated AWS credentials file, read by Omnibus for S3 cache access', 104 'APPLE_ACCOUNT': 'Apple developer account used for notarization', 105 'NOTARIZATION_ATTEMPTS': 'Number of retries for notarization steps', 106 'NOTARIZATION_PWD': 'App-specific password for notarization', 107 'NOTARIZATION_TIMEOUT': 'Timeout for xcrun notarytool wait', 108 'TEAM_ID': 'Apple developer team ID used for notarization', 109 'KEYCHAIN_NAME': 'Name of the ephemeral keychain holding signing certificates', -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/omnibus.py line 96
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'Used to sign packages'
95 'DEB_GPG_KEY_NAME': 'Used to sign packages', 96 'DEB_SIGNING_PASSPHRASE': 'Used to sign packages', 97 'LD_PRELOAD': 'Needed to fake armv7l architecture (via libfakearmv7l.so, see Dockerfile for rpm_armhf buildimage)', 98 'RPM_GPG_KEY': 'Used to sign packages', 99 'RPM_GPG_KEY_NAME': 'Used to sign packages', 100 'RPM_SIGNING_PASSPHRASE': 'Used to sign packages', 101 }, 102 'darwin': { 103 'AWS_SHARED_CREDENTIALS_FILE': 'Path to the CI Identities-populated AWS credentials file, read by Omnibus for S3 cache access', 104 'APPLE_ACCOUNT': 'Apple developer account used for notarization', 105 'NOTARIZATION_ATTEMPTS': 'Number of retries for notarization steps', -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/kmt_tests.py line 125
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'from-env'
124 os.environ["DD_BAZEL_REMOTE_CACHE"] = "off" 125 os.environ["BUILDBARN_ID_TOKEN"] = "from-env" 126 self.assertIsNone(compiler.get_buildbarn_token(self.ctx)) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/issue_tests.py line 134
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'fake-token'
133 'os.environ', 134 {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'fake-token'}, 135 ) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/gitlab_api_tests.py line 697
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'fake-token'
696 mock_response = MagicMock(ok=True) 697 mock_response.json.return_value = {'token': 'fake-token'} 698 mock_session = mock_session_cls.return_value -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/issue_tests.py line 191
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'fake-token'
190 { 191 'SLACK_DATADOG_AGENT_BOT_TOKEN': 'fake-token', 192 }, 193 ) 194 @patch('tasks.issue.GithubAPI') -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/issue_tests.py line 231
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'fake-token'
230 'os.environ', 231 {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'fake-token'}, 232 ) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/issue_tests.py line 277
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'fake-token'
276 'os.environ', 277 {'PR_REQUESTED_TEAMS': '[{"slug": "team1"}]', 'SLACK_DATADOG_AGENT_BOT_TOKEN': 'fake-token'}, 278 ) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/issue_tests.py line 324
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'fake-token'
323 'os.environ', 324 {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'fake-token'}, 325 ) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/issue_tests.py line 367
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'fake-token'
366 'os.environ', 367 {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'fake-token'}, 368 ) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/issue_tests.py line 20
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'fake-token'
19 'os.environ', 20 {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'fake-token'}, 21 ) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/issue_tests.py line 71
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'fake-token'
70 'os.environ', 71 {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'fake-token'}, 72 ) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/issue_tests.py line 103
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'fake-token'
102 'os.environ', 103 {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'fake-token'}, 104 ) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/issue_tests.py line 165
- Likely real
- Yes, 94% confidence
Possible hardcoded password: 'fake-token'
164 'os.environ', 165 {'SLACK_DATADOG_AGENT_BOT_TOKEN': 'fake-token'}, 166 ) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/gitlab_api_tests.py line 702
- Likely real
- Yes, 93% confidence
Possible hardcoded password: 'legacy-token'
701 702 @patch.dict('os.environ', {'GITLAB_TOKEN': 'legacy-token'}) 703 @patch('tasks.libs.ciproviders.gitlab_api.running_in_ci', return_value=True) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/gitlab_api_tests.py line 738
- Likely real
- Yes, 93% confidence
Possible hardcoded password: 'local-token'
737 738 @patch.dict('os.environ', {'GITLAB_TOKEN': 'local-token'}) 739 @patch('tasks.libs.ciproviders.gitlab_api.running_in_ci', return_value=False) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/dynamic_test/jev_selection_tests.py line 27
- Likely real
- Yes, 93% confidence
Possible hardcoded password: 'custom-token'
26 self.assertEqual( 27 select.call_args.kwargs, {"dc": "us1.ddbuild.io", "token_cmd": "custom-token", "pr_summary": ""} 28 ) -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cmd/serverless-init/cloudservice/service.go line 203
- Likely real
- Yes, 93% confidence
Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info]
func GetCloudServiceType() CloudService { arch := runtime.GOARCH if isMicroVM() { -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cmd/system-probe/subcommands/usm/sysinfo_linux.go line 104
- Likely real
- Yes, 93% confidence
Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info]
// Get hostname hostname, err := os.Hostname() if err != nil { sysInfo.Hostname = fmt.Sprintf("<unable to detect: %v>", err) -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cmd/serverless-init/cloudservice/service.go line 117
- Likely real
- Yes, 93% confidence
Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info]
func (l *LocalService) GetTags() map[string]string { hostname, err := os.Hostname() if err != nil { log.Warnf("failed to get hostname for local usage metric instance tag: %v", err) -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /.dda/extend/commands/gh/cherry_pick_pr/__init__.py line 154
- Likely real
- Yes, 93% confidence
Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
g = Github(os.getenv("GITHUB_TOKEN")) repo = g.get_repo("DataDog/datadog-agent") pr = repo.get_pull(pr_number) -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cmd/secret-generic-connector/backend/hashicorp/vault.go line 80
- Likely real
- Yes, 93% confidence
Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
tokenPath := os.Getenv("DD_SECRETS_SA_TOKEN_PATH") if tokenPath == "" { if configPath := sessionConfig.VaultKubernetesJWTPath; configPath != "" { -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /.dda/extend/commands/gh/cherry_pick_pr/__init__.py line 55
- Likely real
- Yes, 93% confidence
Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
# Authenticate to GitHub and get a token token = os.getenv("GITHUB_TOKEN") if not token: app.abort("GITHUB_TOKEN is not set") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/libs/dynamic_test/jev_selection_tests.py line 22
- Likely real
- Yes, 91% confidence
Possible hardcoded password: 'custom-token'
21 select.return_value = {"run": ["TestA"], "skip": [], "decisions": []} 22 with patch.dict("os.environ", {"JEV_DC": "us1.ddbuild.io", "JEV_TOKEN_CMD": "custom-token"}): 23 self.assertEqual(jev_selection("installer"), select.return_value) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/omnibus.py line 106
- Likely real
- Yes, 91% confidence
Possible hardcoded password: 'App-specific password for notarization'
105 'NOTARIZATION_ATTEMPTS': 'Number of retries for notarization steps', 106 'NOTARIZATION_PWD': 'App-specific password for notarization', 107 'NOTARIZATION_TIMEOUT': 'Timeout for xcrun notarytool wait', 108 'TEAM_ID': 'Apple developer team ID used for notarization', 109 'KEYCHAIN_NAME': 'Name of the ephemeral keychain holding signing certificates', 110 'KEYCHAIN_PWD': 'Password for the ephemeral signing keychain', 111 }, 112 } 113 114 115 def _get_environment_for_cache(env: dict[str, str]) -> dict: 116 """ -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/omnibus.py line 110
- Likely real
- Yes, 91% confidence
Possible hardcoded password: 'Password for the ephemeral signing keychain'
109 'KEYCHAIN_NAME': 'Name of the ephemeral keychain holding signing certificates', 110 'KEYCHAIN_PWD': 'Password for the ephemeral signing keychain', 111 }, 112 } 113 114 115 def _get_environment_for_cache(env: dict[str, str]) -> dict: 116 """ 117 Compute a hash from the environment after excluding irrelevant/insecure 118 environment variables to ensure we don't omit a variable 119 """ 120 excluded_variables = { -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/omnibus.py line 20
- Likely real
- Yes, 89% confidence
Possible hardcoded password: 'OIDC token used by the Bazel credential helper to authenticate against the Buildbarn remote cache'
19 'BAZELISK_HOME': "Runner-dependent cache path used by `bazelisk` to manage `bazel` installations", 20 'BUILDBARN_ID_TOKEN': "OIDC token used by the Bazel credential helper to authenticate against the Buildbarn remote cache", 21 'CI': "dda and `bazel` rely on this to be able to tell whether they're running on CI and adapt behavior", 22 'GITLAB_CI': "dda relies on this to be able to tell whether it's running on GitLab CI specifically and adapt behavior", 23 'DD_CC': 'Points at c compiler', 24 'DD_CXX': 'Points at c++ compiler', 25 'GONOSUMDB': 'Go module checksum bypass, set by .adms/go/gitlab.yaml and forwarded to Bazel via --repo_env', 26 'GOPRIVATE': 'Go private module patterns, set by .adms/go/gitlab.yaml and forwarded to Bazel via --repo_env', 27 'GOPROXY': 'Go module proxy, set by .adms/go/gitlab.yaml and forwarded to Bazel via --repo_env', 28 'SKIP_PKG_COMPRESSION': 'Skip package XZ compression (set to true for faster local builds)', 29 'DDA_NO_DYNAMIC_DEPS': 'Variable affecting dda behavior', 30 'E2E_COVERAGE_PIPELINE': 'Used to do a special build of the agent to generate coverage data', 31 'DEPLOY_AGENT': 'Used to apply higher compression level for deployed artifacts', 32 'FORCED_PACKAGE_COMPRESSION_LEVEL': 'Used as an override for the compression level of artifacts', 33 'GEM_HOME': 'rvm / Ruby stuff to make sure Omnibus itself runs correctly', 34 'GEM_PATH': 'rvm / Ruby stuff to make sure Omnibus itself runs correctly', 35 'HOME': 'Home directory might be used by invoked programs such as git', 36 'INSTALL_DIR': 'Used by Omnibus to determine the target install directory when building the package', 37 'INTEGRATIONS_WHEELS_STORAGE': 'Storage tier ("dev" or "stable") for integration dependency wheels, expanded by pip in lockfiles', 38 'MY_RUBY_HOME': 'rvm / Ruby stuff to make sure Omnibus itself runs correctly', 39 'OMNIBUS_FORCE_PACKAGES': 'Force Omnibus to build actual packages', 40 'OMNIBUS_GIT_CACHE_DIR': 'Local directory used by Omnibus for the local git cache', 41 'OMNIBUS_PACKAGE_ARTIFACT_DIR': 'Directory to take the base artifact from on "packaging-only" mode', 42 'PACKAGE_ARCH': 'Target architecture', 43 'PATH': 'Needed to find binaries', 44 'PKG_CONFIG_LIBDIR': 'pkgconfig variable', 45 'PKG_CONFIG_PATH': 'pkgconfig variable', 46 'PYTHONUTF8': 'Hint for Python to use UTF-8', 47 'RUBY_VERSION': 'Used by Omnibus / Gemspec', 48 'S3_OMNIBUS_CACHE_ANONYMOUS_ACCESS': 'Use to determine whether Omnibus can write to the artifact cache', 49 'S3_OMNIBUS_CACHE_BUCKET': 'Points at bucket used for Omnibus source artifacts', 50 'SSH_AUTH_SOCK': 'Developer environments configure Git to use SSH authentication', 51 'XDG_CACHE_HOME': "Runner-dependent cache path used by `bazel` (natively on POSIX OSes, emulated on Windows)", 52 'rvm_path': 'rvm / Ruby stuff to make sure Omnibus itself runs correctly', 53 'rvm_bin_path': 'rvm / Ruby stuff to make sure Omnibus itself runs correctly', 54 'rvm_prefix': 'rvm / Ruby stuff to make sure Omnibus itself runs correctly', 55 'rvm_version': 'rvm / Ruby stuff to make sure Omnibus itself runs correctly', 56 'CI_JOB_ID': 'CI Job ID', 57 'CI_PROJECT_NAME': 'CI Project Name', 58 'CI_JOB_NAME_SLUG': 'CI Job Name Slug', 59 } 60 61 OS_SPECIFIC_ENV_PASSTHROUGH = { 62 'win32': { -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /.dda/extend/pythonpath/lab/providers/local/kind.py line 100
- Likely real
- Yes, 83% confidence
Detects fully silent process execution (suppressing all output channels) [threat-process-spawn-silent]
retcode = app.subprocess.attach( ["docker", "ps"], stderr=subprocess.DEVNULL, stdout=subprocess.DEVNULL, check=False ).returncode if retcode != 0: -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /tasks/kernel_matrix_testing/tool.py line 84
- Likely real
- Yes, 83% confidence
Detects fully silent process execution (suppressing all output channels) [threat-process-spawn-silent]
return if subprocess.run(["sudo", "-n", "true"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL).returncode == 0: return if not sys.stdin.isatty(): -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/e2e_framework_tool_tests.py line 95
- Likely real
- Yes, 70% confidence
Possible hardcoded password: '/tmp/pass'
94 # Empty is a valid passphrase, so presence -- not truthiness -- is what counts. 95 for ambient in ({"PULUMI_CONFIG_PASSPHRASE": ""}, {"PULUMI_CONFIG_PASSPHRASE_FILE": "/tmp/pass"}): 96 with self.subTest(ambient=ambient), mock.patch.dict("os.environ", ambient, clear=True): -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/bazel.py line 7
- Likely real
- Yes, 52% confidence
Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
6 import tempfile 7 import xml.etree.ElementTree as ET 8 from pathlib import Path -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kernel_matrix_testing/ci.py line 10
- Likely real
- Yes, 52% confidence
Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
9 import urllib.parse 10 import xml.etree.ElementTree as ET 11 from collections import defaultdict -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/kmt.py line 15
- Likely real
- Yes, 52% confidence
Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
14 import time 15 import xml.etree.ElementTree as ET 16 from collections import defaultdict -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/junit_upload_core.py line 7
- Likely real
- Yes, 52% confidence
Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
6 import tempfile 7 import xml.etree.ElementTree as ET 8 from collections import defaultdict -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/bazel_tests.py line 4
- Likely real
- Yes, 52% confidence
Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
3 import unittest 4 import xml.etree.ElementTree as ET 5 from pathlib import Path -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/package/url.py line 2
- Likely real
- Yes, 51% confidence
Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
1 import tempfile 2 import xml.etree.ElementTree as ET 3 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/virustotal.py line 172
- Likely real
- Yes, 51% confidence
Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
171 ): 172 import xml.etree.ElementTree as ET 173 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/e2e_framework_tool_tests.py line 95
- Likely real
- Uncertain, 45% confidence
Possible hardcoded password: ''
94 # Empty is a valid passphrase, so presence -- not truthiness -- is what counts. 95 for ambient in ({"PULUMI_CONFIG_PASSPHRASE": ""}, {"PULUMI_CONFIG_PASSPHRASE_FILE": "/tmp/pass"}): 96 with self.subTest(ambient=ambient), mock.patch.dict("os.environ", ambient, clear=True): -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/agent_ci_api.py line 104
- Likely real
- Uncertain, 44% confidence
Possible hardcoded password: ''
103 104 token = '' 105 if not is_local: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/renovate.py line 477
- Likely real
- Probably noise, 28% confidence
Try, Except, Continue detected.
476 result = eval(expr, {"__builtins__": {}}, namespace) # noqa: S307 — namespace is preamble-only scalars 477 except Exception: 478 continue 479 if isinstance(result, str) and result.startswith("http"): -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/go_mod_formatter_tests.py line 62
- Likely real
- Probably noise, 25% confidence
subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell
61 assert len(output) == 0, output 62 subprocess.run('rm ./tasks/unit_tests/testdata/go_mod_formatter/format_package_test/go.mod', shell=True) 63 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/go_mod_formatter_tests.py line 49
- Likely real
- Probably noise, 25% confidence
subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell
48 assert len(output) == 0, output 49 subprocess.run('rm ./tasks/unit_tests/testdata/go_mod_formatter/format_package_test/go.mod', shell=True) 50 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/go_mod_formatter_tests.py line 25
- Likely real
- Probably noise, 24% confidence
subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell
24 subprocess.run( 25 'rm ./tasks/unit_tests/testdata/go_mod_formatter/format_package_test/go.mod', shell=True, capture_output=True 26 ) 27 p = subprocess.run(f"cp {src} {dest}", shell=True) 28 assert p.returncode == 0 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /.dda/extend/pythonpath/lab/providers/local/kind.py line 238
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
237 """Check if the developer environment is running.""" 238 import subprocess 239 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /bazel/rules/go_mod_tidy_all/go_mod_tidy_all.py line 12
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
11 from datetime import timedelta 12 from subprocess import PIPE, CalledProcessError 13 from traceback import format_exception_only -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/bpftool.py line 6
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
5 import json 6 import subprocess 7 from typing import Dict, Generator, List, Optional -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/bpftool.py line 14
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
13 from .streaming import iter_json_objects 14 from ..subprocess_utils import safe_subprocess_run 15 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/bpftool_downloader.py line 15
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
14 from ..logging_config import logger 15 from ..subprocess_utils import safe_subprocess_run 16 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/ebpf_backend.py line 11
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
10 from ..logging_config import logger 11 from ..subprocess_utils import safe_subprocess_run 12 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/system_probe.py line 6
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
5 import os 6 import subprocess 7 from typing import Dict, Generator, List, Optional -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/system_probe.py line 14
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
13 from ..models import ConnTuple 14 from ..subprocess_utils import safe_subprocess_run 15 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /omnibus/python-scripts/packages_tests.py line 88
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
87 def test_run_command_failure_returns_nonzero_rc(self): 88 import subprocess 89 with patch('subprocess.run') as mock_run: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/utils.py line 23
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
22 from pathlib import Path 23 from subprocess import check_output, list2cmdline 24 from types import SimpleNamespace -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/go_tests.py line 1
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
1 import subprocess 2 import unittest 3 from unittest.mock import MagicMock, patch -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/unit_tests/junit_tests.py line 5
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
4 from pathlib import Path 5 from subprocess import CalledProcessError 6 from unittest.mock import patch -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/system_probe.py line 16
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
15 from pathlib import Path 16 from subprocess import check_output 17 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/ebpf_backend.py line 5
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
4 5 import subprocess 6 from abc import ABC, abstractmethod -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/junit_upload_core.py line 13
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
12 from shutil import which 13 from subprocess import check_call 14 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/types/types.py line 2
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
1 import re 2 import subprocess 3 from dataclasses import dataclass -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/tools/clang_format.py line 26
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
25 try: 26 from subprocess import DEVNULL # py3k 27 except ImportError: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/dynamic_test/jev/jev_client.py line 10
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
9 import shlex 10 import subprocess 11 import urllib.error -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/bpftool_downloader.py line 7
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
6 import platform 7 import subprocess 8 import tarfile -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/e2e_framework/aws/deploy.py line 2
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
1 import os 2 import subprocess 3 from typing import Any -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/common/bazel_query.py line 7
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
6 import shutil 7 import subprocess 8 import threading -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /tasks/libs/dynamic_test/jev/pr_context.py line 7
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
6 import os 7 import subprocess 8 import urllib.request -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /.dda/extend/pythonpath/lab/providers/local/kind.py line 10
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
9 import shutil 10 import subprocess 11 import tempfile -
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/kernel_matrix_testing/vmconfig.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Dockerfiles/dogstatsd/alpine/probe.sh
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/cluster_agent.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/k8s_versions.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/python_version.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/unit_tests/download_tests.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/unit_tests/url_tests.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/unit_tests/release_tests.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/unit_tests/omnibus_tests.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tools/host-profiler/Dockerfile
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /.gitlab/.pre/deps_fetch/deps_fetch.yml
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /.gitlab/.pre/deps_build/deps_build.yml
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /pkg/config/legacy/testdata/config.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /pkg/fleet/installer/setup/install.sh
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cmd/system-probe/subcommands/usm/debug_scripts/usm_leak_detector/backends/bpftool_downloader.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cmd/agent/install_script.sh
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cmd/agent/aix/install_aix.sh
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Dockerfiles/otel-agent/Dockerfile
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/libs/ciproviders/gitlab_api.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /deps/cacerts/update_cacerts.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/collector.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/agent.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/renovate.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/omnibus.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/install_tasks.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/libs/package/url.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/licenses.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/gpu.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/system_probe.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/libs/dynamic_test/jev/jev_client.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/libs/dynamic_test/jev/pr_context.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/libs/common/download.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/gotest.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/libs/common/utils.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/kernel_matrix_testing/download.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /tasks/kernel_matrix_testing/provision/bata24.sh
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
No findings match these filters.