MalDet · Static Security Report
This repository has been flagged as having a high vulnerability risk score of 180, which means that an attacker could easily exploit insecure coding patterns to break into your system or steal data. While the code does not appear to be intentionally malicious based on other checks, it contains several dangerous regular expressions that could crash your application if used incorrectly. Additionally, there are multiple instances where code attempts to execute base64-encoded payloads or obfuscated strings directly from the file system, which poses a significant threat of remote code execution. You should treat these findings as serious security concerns and avoid using this repository in any production environment until you can review and fix the dangerous code patterns.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 9 | 96 | 1 | 106 |
| yara | Signatures of malicious behaviour in source files | 46 | 0 | 0 | 46 |
23 of 152 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Generic Secret detected | 1 | /KuGougainianban.js:18 |
| high | semgrep | JWT token detected | 5 | /insck.js:2 |
| high | yara | YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed | 2 | /123_extracted/123/static/js/chunk-vendors.53e0e8c6.js |
| high | semgrep | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities | 3 | /RSA.js:4016 |
| high | yara | YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together | 44 | /123_extracted/123/static/js/pagesC-contentDetails-contentDetails.07c2eec1.js |
| medium | semgrep | RegExp() called with a `s` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in | 1 | /lsp/zhibojuhe.js:2 |
| medium | semgrep | RegExp() called with a `F` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in | 1 | /kugouv5.js:1 |
| medium | semgrep | RegExp() called with a `k` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in | 1 | /TgRedirect.js:26 |
| medium | semgrep | RegExp() called with a `width` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle | 1 | /RSA.js:4468 |
| medium | semgrep | RegExp() called with a `y` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in | 1 | /AppRavenTask.js:5 |
| medium | semgrep | Cannot determine what 'tabsHTML' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'tabsHTML' is not externally controlled, or sanitize this data. | 2 | /KDF/video-parser.js:376 |
| medium | semgrep | Cannot determine what 'curMedia' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'curMedia' is not externally controlled, or sanitize this data. | 2 | /KDF/video-parser.js:416 |
| medium | semgrep | Cannot determine what 'streamsHTML' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'streamsHTML' is not externally controlled, or sanitize this data. | 1 | /KDF/video-parser.js:378 |
| medium | semgrep | Cannot determine what 'qBtns' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'qBtns' is not externally controlled, or sanitize this data. | 1 | /KDF/video-parser.js:417 |
| medium | semgrep | Cannot determine what 'newData' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'newData' is not externally controlled, or sanitize this data. | 1 | /kugou.js:203 |
| medium | semgrep | Cannot determine what 'epsHTML' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'epsHTML' is not externally controlled, or sanitize this data. | 1 | /KDF/video-parser.js:419 |
| medium | semgrep | Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. | 10 | /kugou.js:447 |
| medium | semgrep | Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. | 27 | /RSA.js:4817 |
| medium | semgrep | RegExp() called with a `t` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in | 3 | /insav.tv.js:58 |
| medium | semgrep | RegExp() called with a `e` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in | 43 | /lsp/wm4k.js:29 |
| low | semgrep | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. | 1 | /LectMate.js:23 |