MalDet · Static Security Report
13 findings likely need attention, 22 look like noise. Most notable: Detects download-and-execute patterns: fetching a remote file then executing it [threat... (95% confidence).
Generated from finding counts. A plain-English summary was not available for this scan.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| bandit | Insecure coding patterns in Python source | 0 | 4 | 12 | 16 |
| guarddog | Malicious package and install-time behaviour | 3 | 3 | 7 | 13 |
| yara | Signatures of malicious behaviour in source files | 8 | 0 | 3 | 11 |
13 of 40 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | guarddog | Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec] | 3 | /frontend/app/src/pages/main/v1/overview/components/onboarding-steps.tsx:521 |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 7 | /hack/install/install.sh |
| high | yara | YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this | 1 | /hack/install/install.sh |
| medium | guarddog | Detects unicode homoglyphs and uncommon characters used for obfuscation [threat-runtime-obfuscation-unicode] | 1 | /pkg/repository/payloadstore.go:344 |
| medium | guarddog | Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] | 2 | /sdks/ruby/src/lib/hatchet/config.rb:131 |
| medium | bandit | Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. | 2 | /sdks/python/hatchet_sdk/embedded.py:195 |
| medium | bandit | Possible SQL injection vector through string-based query construction. | 1 | /hack/db/generate-oss-db-model.py:383 |
| medium | bandit | Possible binding to all interfaces. | 1 | /sdks/python/hatchet_sdk/config.py:48 |
| low | guarddog | Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read] | 3 | /cmd/hatchet-api/api/run.go:18 |
| low | guarddog | Detects fully silent process execution (suppressing all output channels) [threat-process-spawn-silent] | 3 | /sdks/typescript/jest.e2e-global-setup.ts:84 |
| low | guarddog | Detects LOLBAS usage in install hooks (execution and network tools) [threat-process-hooks] | 1 | /sdks/typescript/package.json:112 |
| low | bandit | Possible hardcoded password: '' | 1 | /sdks/python/hatchet_sdk/clients/rest/configuration.py:511 |
| low | bandit | Try, Except, Continue detected. | 1 | /sdks/python/hatchet_sdk/worker/worker.py:762 |
| low | bandit | Consider possible security implications associated with the subprocess module. | 1 | /sdks/python/hatchet_sdk/embedded.py:7 |
| low | bandit | subprocess call - check for execution of untrusted input. | 1 | /sdks/python/hatchet_sdk/embedded.py:379 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 3 | /hack/install/install.sh |
| low | bandit | Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. | 8 | /sdks/python/hatchet_sdk/connection.py:23 |