MalDet · Static Security Report
This repository has a medium vulnerability risk score of 55.0, which means there are several insecure coding patterns that an attacker could potentially exploit if they gain access to the code. While the malicious-pattern risk is very low at 2.0, suggesting the code does not appear to be intentionally harmful, the most concerning issues involve unsafe subprocess calls and shell usage that could lead to command injection attacks. Additionally, there are supply chain risks because some dependencies like 'sympy' lack version locks, making them vulnerable to tampering by others who control their installation. The scan also flagged a specific YARA rule indicating that downloading files from the internet and executing them together is a dangerous combination, which requires careful handling. Overall, while the code may not be malicious, it contains significant security holes that should be addressed before using this library in production environments.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| bandit | Insecure coding patterns in Python source | 7 | 5 | 20 | 32 |
| semgrep | Insecure coding patterns across many languages | 0 | 15 | 0 | 15 |
| yara | Signatures of malicious behaviour in source files | 1 | 0 | 0 | 1 |
| dep_checker | Vulnerable, unpinned or typosquatted dependencies | 0 | 1 | 0 | 1 |
11 of 49 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | bandit | Starting a process with a shell, possible injection detected, security issue. | 7 | /galgebra/printer.py:1034 |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 1 | /scripts/validate_nb_refresh.py |
| medium | dep_checker | Unpinned dependency: 'sympy' has no version lock — supply chain risk | 1 | pyproject.toml |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 10 | /.github/workflows/ci.yml:31 |
| medium | semgrep | Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. | 5 | /galgebra/printer.py:1157 |
| medium | bandit | Use of possibly insecure function - consider using safer ast.literal_eval. | 5 | /galgebra/ga.py:636 |
| low | bandit | Consider possible security implications associated with the subprocess module. | 2 | /galgebra/gprinter.py:2 |
| low | bandit | Starting a process with a partial executable path | 5 | /galgebra/gprinter.py:262 |
| low | bandit | subprocess call - check for execution of untrusted input. | 10 | /galgebra/gprinter.py:264 |
| low | bandit | Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. | 3 | /galgebra/dop.py:358 |