MalDet · Static Security Report
This repository has two distinct security issues that require immediate attention. The most critical finding is a vulnerability score of 789, which indicates serious insecure coding patterns that an attacker could exploit to inject malicious code into the system. Additionally, there are several medium-risk findings related to potential malicious intent, such as hardcoded PGP keys and suspicious command execution patterns, which suggest the code might be intentionally harmful or obfuscated. While some of these issues appear to be standard security practices like avoiding unsafe file operations, they still represent significant risks that should not be ignored without careful review.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 52 | 336 | 3 | 391 |
| yara | Signatures of malicious behaviour in source files | 18 | 0 | 9 | 27 |
| bandit | Insecure coding patterns in Python source | 5 | 3 | 14 | 22 |
| guarddog | Malicious package and install-time behaviour | 0 | 4 | 11 | 15 |
101 of 455 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. | 1 | /go/libcmdline/fork_nix.go:41 |
| high | semgrep | Detected calls to child_process from a function argument `action`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. | 1 | /shared/desktop/app/ipc-handlers.desktop.tsx:191 |
| high | semgrep | Detected calls to child_process from a function argument `args`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. | 1 | /shared/desktop/app/exec.desktop.tsx:49 |
| high | semgrep | Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit. | 4 | /go/fuzz/pgp_key_read/corpus/1:53 |
| high | semgrep | Missing mutex unlock (`api.clientsMu` variable) before returning from a function. This could result in panics resulting from double lock operations | 1 | /go/libkb/api.go:143 |
| high | semgrep | Missing mutex unlock (`lock.lock` variable) before returning from a function. This could result in panics resulting from double lock operations | 1 | /go/chat/utils/locktab.go:124 |
| high | semgrep | Facebook OAuth detected | 2 | /go/chat/unfurl/testcases/pinterest0.html:463 |
| high | semgrep | `Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the ser | 1 | /go/kbfs/libpages/server.go:372 |
| high | semgrep | Found 'subprocess' function 'check_output' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. | 2 | /go/tools/airdrop-setup/airdrop-setup.py:71 |
| high | semgrep | Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. | 1 | /go/tools/airdrop-setup/airdrop-setup.py:46 |
| high | semgrep | bcrypt hash detected | 1 | /go/kbfs/libpages/config/passwords.go:153 |
| high | semgrep | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. | 26 | /go/pinentry/pinentry.go:132 |
| high | semgrep | Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file. | 1 | /go/kbfs/kbfscrypto/root_certs.go:99 |
| high | bandit | Starting a process with a shell, possible injection detected, security issue. | 2 | /go/tools/airdrop-setup/airdrop-setup.py:55 |
| high | bandit | subprocess call with shell=True identified, security issue. | 3 | /go/tools/airdrop-setup/airdrop-setup.py:71 |
| high | semgrep | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. | 9 | /packaging/linux/docker/standard/Dockerfile:39 |
| high | yara | YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed | 4 | /shared/scripts/react-compiler-bailouts.mts |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 7 | /packaging/linux/docker/Dockerfile |
| high | yara | YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together | 1 | /shared/common-adapters/icon.tsx |
| high | yara | YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this | 6 | /packaging/linux/rpm/postinst.template |
| medium | semgrep | Variable `result` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference | 7 | /go/updater/keybase/platform_linux.go:98 |
| medium | semgrep | Variable `rres` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference | 2 | /go/stellar/stellar.go:867 |
| medium | semgrep | Variable `maxDelH` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference | 2 | /go/protocol/chat1/extras.go:1660 |
| medium | semgrep | Variable `obr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference | 1 | /go/chat/sender.go:1422 |
| medium | semgrep | Variable `candidate` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference | 1 | /go/teams/service_helper.go:473 |
| medium | semgrep | Variable `spotlightResult` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference | 1 | /go/updater/keybase/platform_darwin.go:360 |
| medium | semgrep | Variable `cmd` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference | 1 | /go/keybase/main.go:196 |
| medium | semgrep | Variable `md` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference | 1 | /go/kbfs/libkbfs/disk_block_cache.go:830 |
| medium | semgrep | Variable `ret` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference | 1 | /go/libkb/upak_loader.go:661 |
| medium | semgrep | Variable `quarantineResult` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference | 1 | /go/updater/keybase/platform_darwin.go:367 |
| medium | semgrep | Variable `res` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference | 1 | /go/teams/service_helper.go:952 |
| medium | semgrep | A request was found to be crafted from user-input `req`. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft the base request, but to be treated as part of the path or query paramete | 1 | /go/chat/attachment_httpsrv.go:393 |
| medium | semgrep | The application's App Transport Security (ATS) configuration does not leverage the in-built public key pinning mechanisms. The application should consider leverage ATS public key pinning to ensure that the application only communicates to serves with an allow-listed certificate (and public key). By | 17 | /shared/ios/KeybaseShare/Info.plist:3 |
| medium | semgrep | Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY. | 2 | /shared/android/app/src/main/java/io/keybase/ossifrage/KeyStore.kt:193 |
| medium | semgrep | Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. | 1 | /go/chat/attachment_httpsrv.go:362 |
| medium | semgrep | Variable `inbox` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference | 1 | /go/chat/helper.go:596 |
| medium | semgrep | Detected an element with disabled HTML escaping. If external data can reach this, this is a cross-site scripting (XSS) vulnerability. Ensure no external data can reach here, or remove 'escape=false' from this element. | 4 | /go/chat/unfurl/testcases/pinterest0.html:463 |
| medium | semgrep | Iteration over a possibly empty map `parentsToAddChainsFor`. This is likely a bug or redundant code | 1 | /go/kbfs/libkbfs/folder_branch_ops.go:6336 |
| medium | semgrep | Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `html/templat | 1 | /go/chat/attachment_httpsrv.go:339 |
| medium | guarddog | Detects unicode homoglyphs and uncommon characters used for obfuscation [threat-runtime-obfuscation-unicode] | 1 | /go/kbtime/long_duration.go:12 |
| medium | guarddog | Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] | 3 | /go/libkb/env.go:733 |
| medium | semgrep | The application's App Transport Security (ATS) configuration allows for local networking, which in some iOS versions is blocked by default in ATS. Consider whether or not the application requires this in release builds, or for development reasons only. This follows the principle of least privelege, | 1 | /shared/ios/Keybase/Info.plist:52 |
| medium | semgrep | Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks. | 6 | /go/chat/unfurl/testcases/twitter0.html:319 |
| medium | semgrep | RegExp() called with a `filter` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll | 1 | /shared/util/string.tsx:15 |
| medium | semgrep | The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access to your application's control plane. | 1 | /shared/android/app/src/main/AndroidManifest.xml:27 |
| medium | bandit | Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called | 1 | /shared/tools/fonts/font_tool.py:157 |
| medium | semgrep | Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. | 2 | /go/chat/attachment_httpsrv.go:483 |
| medium | semgrep | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. | 5 | /go/chat/attachments/s3.go:265 |
| medium | semgrep | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. | 1 | /go/chat/storage/inbox.go:427 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 1 | /.github/workflows/issues.yml:13 |
| medium | semgrep | Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information. | 2 | /shared/perf/run-desktop-cdp-profile.js:33 |
| medium | semgrep | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not automatically escape HTML content, which can leave your application vuln | 1 | /go/chat/emoji/main.go:14 |
| medium | semgrep | The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS="," read -a my_array'. | 1 | /packaging/linux/docker/push.sh:59 |
| medium | semgrep | Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. | 4 | /go/updater/util/unzip.go:173 |
| medium | semgrep | This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL if possible. | 31 | /go/chat/unfurl/testcases/wikipedia0.html:163 |
| medium | semgrep | Do not use `math/rand`. Use `crypto/rand` instead. | 3 | /go/libkb/backoff.go:7 |
| medium | semgrep | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. | 11 | /shared/perf/compare-perf.js:20 |
| medium | semgrep | This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted | 218 | /go/chat/unfurl/testcases/giphy0.html:82 |
| medium | bandit | Probable insecure usage of temp file/directory. | 1 | /go/tools/airdrop-setup/airdrop-setup.py:60 |
| medium | bandit | Call to requests without timeout | 1 | /go/tools/airdrop-setup/airdrop-setup.py:73 |
Showing the 60 most significant of 75 distinct findings. The counts in the previous section cover all of them.