MalDet · Static Security Report
10 findings likely need attention, 19 look like noise. Most notable: Detects keylogging and input capture patterns [threat-runtime-keylogging] (94% confidence).
Generated from finding counts. A plain-English summary was not available for this scan.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 0 | 13 | 5 | 18 |
| guarddog | Malicious package and install-time behaviour | 1 | 1 | 5 | 7 |
| yara | Signatures of malicious behaviour in source files | 4 | 0 | 2 | 6 |
10 of 31 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | guarddog | Detects keylogging and input capture patterns [threat-runtime-keylogging] | 1 | /kubernetes/apps/base/network-system/dex-k8s-authenticator/app/resources/html/static/highlight.pack.min.js:1 |
| high | yara | YARA rule matched: detect_process_injection — Windows process-injection API sequence | 1 | /kubernetes/apps/base/network-system/dex-k8s-authenticator/app/resources/html/static/highlight.pack.min.js |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 2 | /kubernetes/apps/base/ai-system/hermes/app/helmrelease.yaml |
| high | yara | YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this | 1 | /kubernetes/apps/base/network-system/dex-k8s-authenticator/app/resources/html/static/highlight.pack.min.js |
| medium | semgrep | Pod may use the node network namespace. This gives the pod access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. Remove the 'hostNetwork' key to disable this functionality. | 3 | /talos/integrations/cilium/cilium.yaml:13951 |
| medium | guarddog | Detects unicode homoglyphs and uncommon characters used for obfuscation [threat-runtime-obfuscation-unicode] | 1 | /kubernetes/apps/base/network-system/dex-k8s-authenticator/app/resources/html/static/highlight.pack.min.js:1 |
| medium | semgrep | Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information. | 1 | /kubernetes/apps/base/network-system/dex-k8s-authenticator/app/resources/main.go:290 |
| medium | semgrep | In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, | 1 | /talos/integrations/cilium/cilium.yaml:13519 |
| medium | semgrep | In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, | 8 | /kubernetes/apps/base/game-servers/cmangos-ptr/app/db-init-job.yaml:27 |
| low | guarddog | Detects DLL injection and process injection techniques [threat-process-injection-dll] | 2 | /kubernetes/apps/base/network-system/dex-k8s-authenticator/app/resources/html/static/highlight.pack.min.js:1 |
| low | guarddog | Detects memory scraping and credential dumping from process memory [threat-process-memory] | 3 | /kubernetes/apps/base/network-system/dex-k8s-authenticator/app/resources/html/static/highlight.pack.min.js:1 |
| low | semgrep | When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resou | 5 | /kubernetes/apps/base/preview-system/preview-system/app/resourceset.yaml:103 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 2 | /kubernetes/apps/base/network-system/dex-k8s-authenticator/app/resources/html/static/highlight.pack.min.js |