MalDet · Static Security Report
This repository has been flagged as having critical vulnerabilities because it contains insecure coding patterns that attackers could exploit to run malicious code or steal secrets. While the scan also identified some signs of potentially malicious intent, these findings do not necessarily mean the code is intentionally harmful; they mostly point to common mistakes like using unsafe variable interpolation and exposing secrets in environment variables. The most dangerous issues involve running code as root, which allows attackers to gain full control over the container, and executing base64-encoded payloads that could be used to hide malicious instructions. Although there are some medium-severity findings about supply chain attacks and dependency management, these represent standard practices rather than intentional attempts to harm the system. Overall, while the repository is not completely safe due to the critical vulnerabilities, the presence of many low-confidence findings suggests the code may have been written by a developer who made errors rather than an attacker trying to compromise the system.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 22 | 747 | 0 | 769 |
| yara | Signatures of malicious behaviour in source files | 5 | 0 | 0 | 5 |
| guarddog | Malicious package and install-time behaviour | 1 | 0 | 1 | 2 |
770 of 776 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`'s `script:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treate | 1 | /.github/workflows/kbanalysis.yml:43 |
| high | guarddog | Detects base64 decoding followed by code execution [threat-runtime-obfuscation-base64exec] | 1 | /Automate-PR/dist/src/index.js:12180 |
| high | semgrep | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use | 20 | /testfiles/pinactions/input/action.yml:148 |
| high | semgrep | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. | 1 | /Dockerfile:19 |
| high | yara | YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed | 2 | /Automate-PR/dist/src/index.js |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 2 | /testfiles/dockerfiles/output/Dockerfile-multiple-images |
| high | yara | YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together | 1 | /Automate-PR/dist/src/index.js |
| medium | semgrep | This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: | 3 | /.github/dependabot.yml:9 |
| medium | semgrep | A secret is exposed in the workflow-level `env:` block, making it available to every job and step in this workflow — including any untrusted code run in pull-request workflows. Scope secrets as narrowly as possible: prefer step-level `env:` so the secret is only available where it is actually needed | 2 | /testfiles/joblevelpermskb/input/workflow-level-env.yml:5 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 742 | /testfiles/pinactions/output/pinusingmap.yml:25 |
| low | guarddog | Detects heavy obfuscation techniques commonly used by malware [threat-runtime-obfuscation] | 1 | /Automate-PR/dist/src/index.js:14515 |