MalDet · Static Security Report
The repository has a very low vulnerability score of 0, meaning there are no obvious code errors that an attacker could easily exploit right now. However, the scan also found a medium risk score of 35, which indicates that the code contains patterns suggesting it might be intentionally malicious rather than just accidentally insecure. The most concerning findings involve downloading and executing files from remote sources, using suspicious domains for communication, and running hidden scripts or obfuscated payloads that could compromise the system. While some of these issues appear to be standard security practices like reading environment variables or checking file permissions, others stand out as highly suspicious because they combine dangerous actions with specific indicators of intent. The developer should treat this codebase with caution until the malicious patterns are removed and replaced with safe alternatives.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| yara | Signatures of malicious behaviour in source files | 13 | 0 | 2 | 15 |
| guarddog | Malicious package and install-time behaviour | 2 | 4 | 3 | 9 |
9 of 24 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | guarddog | Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec] | 2 | /web_src/src/components/AgentSidebar/widgets/RichMessage.stories.tsx:94 |
| high | yara | YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed | 1 | /web_src/src/lib/exprEvaluator.ts |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 9 | /release/generate-sbom.sh |
| high | yara | YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together | 1 | /web_src/src/pages/factories/__fixtures__/handlers.ts |
| high | yara | YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this | 2 | /web_src/src/pages/app/__fixtures__/console/superplaneRelease.json |
| medium | guarddog | Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration] | 1 | /pkg/integrations/telegram/client.go:13 |
| medium | guarddog | Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links] | 1 | /pkg/integrations/telegram/client.go:13 |
| medium | guarddog | Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] | 1 | /pkg/integrations/daytona/sandbox_secrets.go:65 |
| medium | guarddog | Detects LOLBAS usage in install hooks (execution and network tools) [threat-process-hooks] | 1 | /release/superplane-cli-npm/package.json:9 |
| low | guarddog | Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read] | 3 | /pkg/billing/polar/client.go:88 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 2 | /scripts/docker/install-go.sh |