MalDet · Static Security Report
This repository has a medium vulnerability score of 67, which means there are several insecure coding patterns that an attacker could potentially exploit if the code is used in a real-world application. The most serious issues involve using shell commands and subprocess calls with shell=True, which can lead to command injection attacks, as well as the use of weak hash functions like MD5 and SHA1 that should be replaced for better security. While there are also signs of potential malicious intent detected by specific rules, these appear to be standard obfuscation techniques or legitimate code modifications rather than intentional malware, so they do not significantly change the overall risk profile. The scan identified 182 total findings, but only a small number of high-priority items like hardcoded passwords and dangerous YARA rule matches were flagged as critical threats. Overall, while the code contains known security risks that need to be addressed through refactoring, it does not appear to contain active malicious code or hidden backdoors based on this analysis.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| bandit | Insecure coding patterns in Python source | 10 | 18 | 137 | 165 |
| yara | Signatures of malicious behaviour in source files | 4 | 0 | 9 | 13 |
| guarddog | Malicious package and install-time behaviour | 0 | 4 | 0 | 4 |
7 of 182 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | bandit | Starting a process with a shell, possible injection detected, security issue. | 4 | /app/py/cuda_project_man/__init__.py:605 |
| high | bandit | subprocess call with shell=True identified, security issue. | 6 | /app/py/cudax_lib.py:676 |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 2 | /app/py/cuda_multi_installer/__init__.py |
| high | yara | YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this | 2 | /app/cudatext.app/Contents/Resources/data/lexlib/Bash script.lcf |
| medium | guarddog | Detects unicode homoglyphs and uncommon characters used for obfuscation [threat-runtime-obfuscation-unicode] | 1 | /app/cudatext.app/Contents/Resources/py/cuda_options_editor/cd_opts_dlg.py:1360 |
| medium | guarddog | Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] | 3 | /app/cudatext.app/Contents/Resources/py/cuda_lexer_detecter/lexertypes.py:4 |
| medium | bandit | Use of weak SHA1 hash for security. Consider usedforsecurity=False | 4 | /app/py/sys/requests/auth.py:205 |
| medium | bandit | Use of weak MD5 hash for security. Consider usedforsecurity=False | 2 | /app/cudatext.app/Contents/Resources/py/sys/requests/auth.py:148 |
| medium | bandit | Use of possibly insecure function - consider using safer ast.literal_eval. | 4 | /app/py/cudax_lib.py:320 |
| medium | bandit | Use of exec detected. | 4 | /app/py/cudatext_reset_plugins.py:12 |
| medium | bandit | Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue. | 3 | /app/cudatext.app/Contents/Resources/py/cuda_options_editor/cd_opts_dlg.py:2143 |
| medium | bandit | Call to requests without timeout | 1 | /tools/download_addons.py:65 |
| low | bandit | Possible hardcoded password: '-' | 1 | /app/py/cuda_testing_perf/__init__.py:460 |
| low | bandit | Possible hardcoded password: '0' | 2 | /app/py/cuda_testing_perf/__init__.py:1322 |
| low | bandit | Starting a process without a shell. | 6 | /app/cudatext.app/Contents/Resources/py/cuda_project_man/__init__.py:635 |
| low | bandit | subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell | 4 | /app/py/cuda_addonman/work_cudatext_updates__sourceforge.py:19 |
| low | bandit | Consider possible security implications associated with the subprocess module. | 21 | /app/cudatext.app/Contents/Resources/py/cuda_addonman/work_cudatext_updates__sourceforge.py:17 |
| low | bandit | Starting a process with a partial executable path | 20 | /app/cudatext.app/Contents/Resources/py/cuda_palette/cd_plug_lib.py:286 |
| low | bandit | subprocess call - check for execution of untrusted input. | 20 | /app/cudatext.app/Contents/Resources/py/cuda_addonman/__init__.py:631 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 9 | /tools/download_addons.py |
| low | bandit | Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. | 63 | /app/cudatext.app/Contents/Resources/py/sys/urllib3/util/ssltransport.py:160 |