MalDet · Static Security Report
The repository Homebrew/homebrew-core has been flagged as having a high vulnerability risk of 122.0 and a high malicious-pattern risk of 74.0, which means the code contains several dangerous patterns that could be exploited by attackers or indicate intentional bad behavior. The most concerning issues include detected cryptocurrency mining activity in files like monero.rb, which suggests the project might be running unauthorized crypto-mining processes, and multiple hardcoded secrets such as API keys and private keys that should never be stored directly in source code. While some findings are standard insecure coding practices like using unencrypted WebSocket connections or storing bcrypt hashes in plain text, these are routine mistakes rather than signs of malicious intent. The presence of YARA rules matching cryptocurrency mining patterns and download-and-execute logic further confirms that the project actively supports or facilitates crypto-mining operations. Because of these specific risks related to crypto-mining and hardcoded credentials, this repository is not safe to use for any production environment without significant remediation efforts.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| yara | Signatures of malicious behaviour in source files | 73 | 0 | 5 | 78 |
| semgrep | Insecure coding patterns across many languages | 12 | 24 | 0 | 36 |
| guarddog | Malicious package and install-time behaviour | 3 | 10 | 5 | 18 |
50 of 132 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the | 1 | /Formula/u/unibilium.rb:61 |
| high | guarddog | Detects cryptocurrency mining activity [threat-process-cryptomining] | 3 | /Formula/m/monero.rb:2 |
| high | semgrep | Generic API Key detected | 1 | /Formula/f/fred.rb:54 |
| high | semgrep | Generic Secret detected | 5 | /Formula/m/mdz.rb:44 |
| high | semgrep | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. | 1 | /Formula/w/wstunnel.rb:39 |
| high | semgrep | JWT token detected | 1 | /Formula/j/jwt-hack.rb:31 |
| high | semgrep | bcrypt hash detected | 2 | /Formula/lib/libxcrypt.rb:58 |
| high | semgrep | Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file. | 1 | /Formula/t/trojan-go.rb:98 |
| high | yara | YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns | 3 | /Formula/x/xmrig.rb |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 3 | /Formula/o/openbao.rb |
| high | yara | YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this | 67 | /Formula/z/zsh-autopair.rb |
| medium | semgrep | Detected non-static command inside system. Audit the input to 'system'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. | 10 | /Formula/g/gitup.rb:46 |
| medium | semgrep | Detected non-static command inside PTY.spawn. Audit the input to 'PTY.spawn'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. | 1 | /Formula/n/nak.rb:39 |
| medium | semgrep | Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing functions instead. | 2 | /Formula/g/grokmirror.rb:62 |
| medium | guarddog | Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration] | 5 | /Formula/j/jimtcl.rb:3 |
| medium | guarddog | Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links] | 5 | /Formula/c/cidr2range.rb:3 |
| medium | semgrep | Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. | 11 | /Formula/p/portable-ruby.rb:161 |
| low | guarddog | Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] | 5 | /Formula/c/container-structure-test.rb:48 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 5 | /Formula/p/pushpin.rb |