MalDet · Static Security Report
This repository has a medium vulnerability score of 46, which indicates that some code patterns are insecure and could be exploited by an attacker if they know how to use them. The most significant issues involve potential command injection through child_process calls and regular expression denial-of-service risks in package handling functions. While the scan also identified several low-priority findings related to loose version constraints and system information collection, these appear to be standard security practices rather than signs of malicious intent. Overall, the code contains exploitable vulnerabilities that need attention before it can be considered safe for production use.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 2 | 21 | 0 | 23 |
| dep_checker | Vulnerable, unpinned or typosquatted dependencies | 0 | 0 | 21 | 21 |
| guarddog | Malicious package and install-time behaviour | 0 | 0 | 3 | 3 |
15 of 47 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. | 2 | /src/utils.js:12 |
| medium | semgrep | RegExp() called with a `packages` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-contro | 1 | /src/packages.js:256 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 9 | /.github/workflows/node.js.yml:18 |
| medium | semgrep | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. | 11 | /src/utils.js:219 |
| low | guarddog | Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info] | 3 | /src/helpers/system.js:23 |
| low | dep_checker | Loose version constraint: 'yamlify-object^0.5.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'os-name^3.1.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'which^1.2.14' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'webpack^5.90.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'webpack-cli^5.1.4' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'prettier^1.19.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'pkg^4.5.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'oxlint^1.68.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@babel/core^7.2.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'minimist^1.2.5' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'jest^22.4.3' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'husky^4.2.5' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'glob^7.1.6' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'github-release-cli^0.4.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'babel-loader^8.0.5' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'all-contributors-cli^4.11.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@commitlint/config-conventional^8.3.4' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@commitlint/cli^8.3.5' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@babel/preset-env^7.3.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@babel/polyfill^7.2.5' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@babel/plugin-proposal-optional-chaining^7.2.0' — attacker could push malicious update | 1 | package.json |