MalDet · Static Security Report
This repository has two major security issues that are serious enough to prevent it from being used in production without immediate fixes. The most critical problem is that the code allows unencrypted file transfers via FTP, which means sensitive data could be stolen over the internet if someone intercepts your connections. Additionally, there are signs of malicious intent because the code contains hardcoded PGP private key blocks and patterns that look like cryptocurrency mining pools, suggesting the developer may have accidentally included secrets or tools designed to steal money. While some findings involve potential XSS vulnerabilities or typosquatting in dependencies, these appear to be ordinary coding mistakes rather than intentional attacks by an attacker. Because of these high-risk issues, you should not use this codebase for any new projects until the FTP and hardcoded secret problems are resolved.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 29 | 75 | 0 | 104 |
| yara | Signatures of malicious behaviour in source files | 53 | 2 | 7 | 62 |
| dep_checker | Vulnerable, unpinned or typosquatted dependencies | 2 | 0 | 56 | 58 |
| guarddog | Malicious package and install-time behaviour | 3 | 4 | 0 | 7 |
63 of 231 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | FTP allows for unencrypted file transfers. Consider using an encrypted alternative. | 19 | /apps/files_external/lib/Lib/Storage/FtpConnection.php:114 |
| high | semgrep | Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit. | 1 | /resources/config/freedesktop.org.xml:289 |
| high | guarddog | Detects DNS-based data exfiltration: encoding data in DNS queries [threat-network-dns-exfil] | 3 | /apps/sharebymail/l10n/da.js:28 |
| high | dep_checker | Typosquatting: 'color' is suspiciously similar to 'colors' | 1 | package.json |
| high | dep_checker | Typosquatting: 'vuex' is suspiciously similar to 'vue' | 1 | package.json |
| high | semgrep | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use | 1 | /.github/workflows/performance.yml:74 |
| high | semgrep | Generic Secret detected | 3 | /.github/workflows/object-storage.yml:53 |
| high | semgrep | Executing non-constant commands. This can lead to command injection. | 5 | /.php-cs-fixer.dist.php:26 |
| high | yara | YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns | 1 | /build/frontend-legacy/package-lock.json |
| high | yara | YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed | 15 | /dist/core-main.js.map |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 5 | /dist/index-HmgsQy8-.chunk.mjs |
| high | yara | YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together | 31 | /dist/settings-vue-settings-profile-contact.js |
| high | yara | YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this | 1 | /.devcontainer/Dockerfile |
| medium | semgrep | Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. | 17 | /apps/theming/src/views/UserTheming.vue:13 |
| medium | semgrep | `query.replace` method will only replace the first occurrence when used with a string argument ('%'). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag. | 1 | /apps/files/src/services/WebDavSearch.ts:69 |
| medium | semgrep | This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: | 4 | /.github/dependabot.yml:236 |
| medium | yara | YARA rule matched: detect_clipboard_hijack — Reads the clipboard alongside crypto-wallet-address-shaped patterns - a known \'clipper\' malware technique that swaps a copied address for the attacker\'s own | 2 | /dist/core-common.js.map |
| medium | guarddog | Detects unicode homoglyphs and uncommon characters used for obfuscation [threat-runtime-obfuscation-unicode] | 1 | /apps/comments/l10n/mk.js:5 |
| medium | guarddog | Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration] | 3 | /dist/6198-6198.js:1 |
| medium | semgrep | The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious d | 1 | /core/src/utils/xhr-request.js:57 |
| medium | semgrep | RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled | 1 | /core/src/Util/get-url-parameter.js:10 |
| medium | semgrep | Detected string concatenation with a non-literal variable in a Doctrine DBAL query method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. | 1 | /lib/private/DB/Middleware/ConnectionActivityConnection.php:41 |
| medium | semgrep | Access-Control-Allow-Origin response header is set to "*". This will disable CORS Same Origin Policy restrictions. | 1 | /status.php:44 |
| medium | semgrep | The function `openssl_decrypt` returns either a string of the decrypted data on success or `false` on failure. If the failure case is not handled, this could lead to undefined behavior in your application. Please handle the case where `openssl_decrypt` returns `false`. | 1 | /apps/encryption/lib/Crypto/Crypt.php:534 |
| medium | semgrep | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. | 4 | /apps/files/src/services/Files.ts:84 |
| medium | semgrep | Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). | 9 | /lib/private/Profiler/FileProfilerStorage.php:125 |
| medium | semgrep | Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. | 35 | /lib/private/Preview/Storage/LocalPreviewStorage.php:111 |
| low | dep_checker | package.json has a 'postinstall' script that runs automatically on npm install — worth a manual look: build/demi.sh ci | 1 | package.json |
| low | dep_checker | Loose version constraint: '@nextcloud/logger^3.0.3' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@nextcloud/e2e-test-server^0.6.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@nextcloud/files^4.1.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@nextcloud/password-confirmation^6.1.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@testing-library/vue^8.1.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@testing-library/jest-dom^7.0.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'marked^18.0.13' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'webdav^5.10.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'vuex^4.1.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'vue^3.5.42' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'vue-router^5.0.6' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'vitest^5.0.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'vite^7.3.6' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'stylelint^17.15.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'sortablejs^1.15.7' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'sass^1.104.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'pinia^4.0.3' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@nextcloud/event-bus^3.3.3' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@nextcloud/vue^9.10.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@nextcloud/vite-config^2.5.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@nextcloud/typings^1.10.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@nextcloud/stylelint-config^3.2.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@nextcloud/sharing^1.0.0-beta.4' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@nextcloud/router^3.1.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@nextcloud/paths^3.1.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@nextcloud/l10n^3.4.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@nextcloud/initial-state^3.0.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@playwright/test^1.63.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@nextcloud/eslint-config^9.0.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@nextcloud/dialogs^7.5.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@nextcloud/capabilities^1.2.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@nextcloud/calendar-availability-vue^3.0.0' — attacker could push malicious update | 1 | package.json |
Showing the 60 most significant of 84 distinct findings. The counts in the previous section cover all of them.