MalDet · Static Security Report
This repository has been flagged as having a medium vulnerability risk of 28.0 and a medium malicious-pattern risk of 20.0, which means the code contains several insecure coding patterns that an attacker could potentially exploit, but it also shows signs that the project may be intentionally designed to be harmful. The most concerning issues are the presence of reverse shell commands in the code, which allow attackers to execute arbitrary commands on a remote server, and the use of weak MD5 hashes for security purposes, both of which represent active threats rather than just poor coding habits. While some findings relate to supply chain risks due to missing version locks for dependencies like Requests and pycryptodomex, these are secondary to the immediate dangers posed by the shell commands and hash weaknesses. The scan did not find evidence that the code is maliciously crafted or specifically designed to cause harm, but rather that it contains dangerous patterns that could be misused if someone with access to this repository were to deploy it.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| bandit | Insecure coding patterns in Python source | 2 | 7 | 10 | 19 |
| yara | Signatures of malicious behaviour in source files | 7 | 0 | 3 | 10 |
| dep_checker | Vulnerable, unpinned or typosquatted dependencies | 0 | 5 | 0 | 5 |
| semgrep | Insecure coding patterns across many languages | 1 | 0 | 0 | 1 |
5 of 35 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Semgrep found a bash reverse shell | 1 | /Core/payload_templates/linux/reverse_tcp/bash_read_line.py:26 |
| high | yara | YARA rule matched: detect_reverse_shell — Reverse shell command patterns | 3 | /Core/payload_templates/linux/reverse_tcp/python3.py |
| high | bandit | Starting a process with a shell, possible injection detected, security issue. | 2 | /Villain.py:1161 |
| high | yara | YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed | 1 | /Core/villain_core.py |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 1 | /Core/Utilities/Shell/fileless_exec/http/src.sh |
| high | yara | YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together | 1 | /Core/villain_core.py |
| high | yara | YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this | 1 | /Villain.py |
| medium | dep_checker | Unpinned dependency: 'netifaces' has no version lock — supply chain risk | 1 | requirements.txt:1 |
| medium | dep_checker | Unpinned dependency: 'pyperclip' has no version lock — supply chain risk | 1 | requirements.txt:3 |
| medium | dep_checker | Unpinned dependency: 'pycryptodomex' has no version lock — supply chain risk | 1 | requirements.txt:2 |
| medium | dep_checker | Unpinned dependency: 'gnureadline' has no version lock — supply chain risk | 1 | requirements.txt:5 |
| medium | bandit | Use of weak MD5 hash for security. Consider usedforsecurity=False | 2 | /Villain.py:490 |
| medium | dep_checker | Unpinned dependency: 'Requests' has no version lock — supply chain risk | 1 | requirements.txt:4 |
| medium | bandit | Possible binding to all interfaces. | 5 | /Core/settings.py:77 |
| low | bandit | Starting a process with a shell: Seems safe, but may be changed in the future, consider rewriting without shell | 2 | /Villain.py:970 |
| low | bandit | Starting a process without a shell. | 1 | /Villain.py:517 |
| low | bandit | Try, Except, Continue detected. | 3 | /Core/villain_core.py:1814 |
| low | bandit | Consider possible security implications associated with the subprocess module. | 2 | /Villain.py:10 |
| low | bandit | Starting a process with a partial executable path | 2 | /Villain.py:970 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 3 | /Core/Utilities/Shell/upload/http/src.sh |