MalDet · Static Security Report
All 46 findings look like noise (low confidence) — nothing here likely needs attention.
Generated from finding counts. A plain-English summary was not available for this scan.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| dep_checker | Vulnerable, unpinned or typosquatted dependencies | 0 | 0 | 45 | 45 |
| yara | Signatures of malicious behaviour in source files | 0 | 0 | 1 | 1 |
0 of 46 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| low | dep_checker | Loose version constraint: 'webpack-dev-server^5.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'html-react-parser^5.1.10' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'redux-thunk^2.3.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'prop-types^15.8.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'react-bootstrap^2.10' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'react-dnd-html5-backend^7.0.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'react-dnd-touch-backend^0.5.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'react-dnd^7.7.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'react-helmet^6.1.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'react-redux^9.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'react-router-dom^5.0.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'recharts^2.15' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'redux-freeze^0.1.7' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@babel/plugin-syntax-dynamic-import^7.8.3' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'redux^4.0.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'reselect^5.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'swagger-ui-react^5.32' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'tinycolor2^1.6.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'tinymce^7.7' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'uuid^9.0.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'video.js^8.21' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'webpack-cli^6.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'webpack^5.105' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'pdfjs-dist^4.10' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@babel/core^7.26' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@babel/preset-env^7.10.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@babel/preset-react^7.10.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@fortawesome/fontawesome-free^6' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@tinymce/tinymce-react^6.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'autoprefixer^10.4.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'babel-loader^8.0.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'bootstrap^5.3' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'circular-dependency-plugin^5.2.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'classnames^2.3.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'core-js^3.31.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'cssnano^6.0.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'd3^7.9.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'eslint-plugin-react^7.21.5' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'eslint^7.15.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'flag-icons^7.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'invariant^2.2.4' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'jsplumb^2.2.11' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'lodash^4.18.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'moment^2.30' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'postcss^8.4.31' — attacker could push malicious update | 1 | package.json |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 1 | /.github/workflows/ci.yml |