MalDet · Static Security Report
This repository has a medium vulnerability risk score of 50, which means there are several insecure coding patterns that could be exploited by an attacker to steal secrets or code. However, the scan also found a low malicious-pattern risk score of 2, indicating that these issues likely stem from ordinary mistakes rather than intentional attacks. The most significant findings involve using variable interpolation in workflow files and allowing Docker containers to run as root, which are common insecure practices but do not necessarily prove malicious intent. Additionally, there is a concern about missing dependency cooldowns and the use of mutable tags or branch references, which could lead to supply-chain attacks if an attacker controls those actions. While some findings involve reading environment variables that might contain secrets, the overall picture suggests these are likely routine security oversights rather than signs of a sophisticated threat actor.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 2 | 26 | 0 | 28 |
| guarddog | Malicious package and install-time behaviour | 0 | 0 | 2 | 2 |
29 of 30 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use | 1 | /.github/workflows/version-bump.yml:29 |
| high | semgrep | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. | 1 | /Dockerfile:15 |
| medium | semgrep | This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: | 1 | /.github/dependabot.yml:10 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 25 | /.github/workflows/autorelease-tag.yml:13 |
| low | guarddog | Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read] | 2 | /cmd/mapcidr/main.go:34 |