MalDet · Static Security Report
The repository has a high vulnerability score of 291.0, which indicates that the code contains many dangerous patterns an attacker could easily use to break things or steal data. While the malicious-pattern score is low at 3.0, suggesting the code isn't intentionally trying to harm others, the high vulnerability score means there are serious security flaws that need immediate attention. Most of these issues stem from common mistakes like forgetting to unlock locks or hardcoding secrets, rather than deliberate attempts to bypass security controls. Because some findings have a very low confidence level, they might be false positives caused by how the scanner works instead of real problems in your codebase.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 17 | 77 | 11 | 105 |
| yara | Signatures of malicious behaviour in source files | 25 | 0 | 7 | 32 |
| guarddog | Malicious package and install-time behaviour | 0 | 0 | 3 | 3 |
78 of 140 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Missing mutex unlock (`pc.mu` variable) before returning from a function. This could result in panics resulting from double lock operations | 2 | /pkg/curatedpackages/packagecontrollerclient.go:161 |
| high | semgrep | AWS Secret Access Key detected | 10 | /designs/snow-integration.md:126 |
| high | semgrep | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. | 1 | /pkg/executables/executables.go:107 |
| high | semgrep | Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file. | 3 | /pkg/executables/testdata/nonemptyprivatekey:1 |
| high | semgrep | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. | 1 | /designs/Dockerfile:18 |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 2 | /Makefile |
| high | yara | YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this | 23 | /pkg/providers/nutanix/testdata/expected_results_external_etcd.yaml |
| medium | semgrep | Variable `result` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference | 12 | /pkg/executables/cmk.go:155 |
| medium | semgrep | Variable `stopResult` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference | 1 | /pkg/executables/cmk.go:451 |
| medium | semgrep | Variable `destroyResult` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference | 1 | /pkg/executables/cmk.go:457 |
| medium | semgrep | Pod is sharing the host process ID namespace. When paired with ptrace this can be used to escalate privileges outside of the container. Remove the 'hostPID' key to disable this functionality. | 3 | /pkg/nodeupgrader/testdata/expected_rest_control_plane_upgrader_pod.yaml:25 |
| medium | semgrep | This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: | 2 | /.github/dependabot.yaml:6 |
| medium | semgrep | Pod may use the node network namespace. This gives the pod access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. Remove the 'hostNetwork' key to disable this functionality. | 4 | /pkg/awsiamauth/testdata/UpgradeAWSIAMAuth-manifest.yaml:93 |
| medium | semgrep | A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Cookie. | 1 | /cmd/eks-a-tool/cmd/vspherelogoutsessions.go:97 |
| medium | semgrep | Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it. | 1 | /pkg/certificates/ssh.go:84 |
| medium | semgrep | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. | 1 | /internal/pkg/oidc/server.go:44 |
| medium | semgrep | Container or pod is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability. | 4 | /pkg/nodeupgrader/testdata/expected_first_control_plane_upgrader_pod.yaml:24 |
| medium | semgrep | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. | 1 | /internal/thirdparty/capc/api/v1beta3/cloudstackfailuredomain_types.go:32 |
| medium | semgrep | `MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as the minimum. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web server must support legacy clients with unsuppor | 10 | /pkg/registry/client.go:47 |
| medium | semgrep | A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct. | 1 | /cmd/eks-a-tool/cmd/vspherelogoutsessions.go:97 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 13 | /.github/workflows/golangci-lint.yml:20 |
| medium | semgrep | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not automatically escape HTML content, which can leave your application vuln | 5 | /pkg/templater/templater.go:7 |
| medium | semgrep | Deserializing into `interface{}` allows arbitrary data structures and types, which can lead to security vulnerabilities (CWE-502). Use a concrete struct type instead. | 3 | /release/cli/pkg/signature/manifest.go:211 |
| medium | semgrep | The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS="," read -a my_array'. | 1 | /hack/cherry_pick_pull.sh:85 |
| medium | semgrep | Checks for disabling of TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks. | 4 | /pkg/certificates/scanner.go:154 |
| medium | semgrep | Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. | 1 | /pkg/tar/untar.go:57 |
| medium | semgrep | Do not use `math/rand`. Use `crypto/rand` instead. | 2 | /pkg/networkutils/ipgenerator.go:5 |
| medium | semgrep | In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, | 2 | /pkg/networking/cilium/testdata/cilium_manifest.yaml:499 |
| medium | semgrep | In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, | 1 | /pkg/nodeupgrader/testdata/expected_rest_control_plane_upgrader_pod.yaml:23 |
| medium | semgrep | In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, | 1 | /pkg/nodeupgrader/testdata/expected_first_control_plane_upgrader_pod.yaml:23 |
| medium | semgrep | In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, | 1 | /config/manager/manager_image_patch.yaml:11 |
| medium | semgrep | In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, | 1 | /pkg/networking/cilium/testdata/cilium_manifest.yaml:742 |
| low | guarddog | Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read] | 3 | /pkg/certificates/config.go:55 |
| low | semgrep | When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resou | 11 | /pkg/networking/cilium/testdata/cilium_manifest.yaml:402 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 7 | /hack/cherry_pick_pull.sh |