MalDet · Static Security Report
This repository has a medium vulnerability score of 40, which means there are some insecure coding patterns that an attacker could potentially exploit if they gain access to the code. However, the scan found no signs of malicious intent or hidden malware in the files themselves, so the code is not actively dangerous right now. The main issues identified are related to how the project handles secrets and package updates rather than intentional attacks. One specific concern involves using variable interpolation with GitHub context data, which could theoretically allow an attacker to inject their own code into the runner. Another issue is that the Dependabot configuration does not set a cooldown period for new packages, meaning unstable or malicious updates could be applied without waiting. These findings represent ordinary insecure coding practices rather than signs of deliberate sabotage. While the repository is safe from immediate malicious attacks, developers should address these two specific issues to improve security posture and prevent future risks.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 1 | 21 | 0 | 22 |
21 of 22 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use | 1 | /.github/workflows/publish-phar.yml:16 |
| medium | semgrep | This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: | 2 | /.github/dependabot.yml:7 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 18 | /.github/workflows/tests.yml:60 |
| medium | semgrep | Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. | 1 | /composer-bump:31 |