MalDet · Static Security Report
This repository presents a medium-level security risk of 34, which means an attacker could potentially exploit some insecure coding patterns to compromise the system. While the code does not appear to be intentionally malicious based on the low malicious-pattern score, there are several significant vulnerabilities that need immediate attention. The most critical issues involve unsafe command execution where user input is not properly validated before running commands or scripts, which allows attackers to inject harmful code. Additionally, the application lacks proper security settings like HTTPS and public key pinning, leaving it vulnerable to man-in-the-middle attacks. There are also signs of potential supply chain risks, such as mutable tags in GitHub Actions steps that could be hijacked by others. Finally, some files contain dangerous patterns that download and execute remote resources, which is a severe threat if the code is used without strict controls. These findings represent ordinary insecure coding practices rather than malicious intent, but they require careful review and remediation before the repository can be considered safe for production use.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 4 | 6 | 0 | 10 |
| yara | Signatures of malicious behaviour in source files | 3 | 0 | 0 | 3 |
| guarddog | Malicious package and install-time behaviour | 0 | 2 | 0 | 2 |
7 of 15 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. | 1 | /cmd/elevate_unix.go:22 |
| high | semgrep | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. | 3 | /internal/platform/platform.go:66 |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 2 | /README_EN.md |
| high | yara | YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this | 1 | /install.sh |
| medium | semgrep | The application's App Transport Security (ATS) configuration does not leverage the in-built public key pinning mechanisms. The application should consider leverage ATS public key pinning to ensure that the application only communicates to serves with an allow-listed certificate (and public key). By | 1 | /macos/Info.plist:3 |
| medium | guarddog | Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration] | 2 | /cmd/update.go:38 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 3 | /.github/workflows/release.yml:43 |
| medium | semgrep | Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. | 1 | /internal/httpproxy/pac.go:49 |
| medium | semgrep | Do not use `math/rand`. Use `crypto/rand` instead. | 1 | /internal/gateway/natdiag.go:7 |