stamparm/maltrail

[MINED127] Cryptominer signature: `supportxmr`: Source contains a known cryptominer signature (`supportxmr`). Could be a deliberate malicious payload, a compromised dependency, or a copy-paste from a…

[MINED127] Cryptominer signature: `xmrig`: Source contains a known cryptominer signature (`xmrig`). Could be a deliberate malicious payload, a compromised dependency, or a copy-paste from a tutorial …

[COMP001] High cognitive complexity: Function `process` has cognitive complexity 45 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested bran…

No test files found

Compose service bind-mounts a sensitive host path

Dockerfile copies the entire context without .dockerignore

[MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows everything including KeyboardInterrupt and bugs.

[MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and SystemExit from working.

[MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and SystemExit from working.

[MINED108] `self.socket` used but never assigned in __init__: Method `server_bind` of class `ThreadingServer` reads `self.socket`, but no assignment to it exists in __init__ (and no class-level fallb…

[MINED108] `self.path` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.path`, but no assignment to it exists in __init__ (and no class-level fallback). This rai…

[MINED108] `self.data` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.data`, but no assignment to it exists in __init__ (and no class-level fallback). This rai…

[MINED108] `self.path` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.path`, but no assignment to it exists in __init__ (and no class-level fallback). This rai…

[MINED108] `self.headers` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.headers`, but no assignment to it exists in __init__ (and no class-level fallback). Th…

[MINED108] `self.send_response` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.send_response`, but no assignment to it exists in __init__ (and no class-level f…

[MINED108] `self.send_header` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.send_header`, but no assignment to it exists in __init__ (and no class-level fallb…

[MINED108] `self.send_response` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.send_response`, but no assignment to it exists in __init__ (and no class-level f…

[MINED108] `self.send_header` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.send_header`, but no assignment to it exists in __init__ (and no class-level fallb…

[MINED108] `self.send_header` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.send_header`, but no assignment to it exists in __init__ (and no class-level fallb…

[MINED108] `self.send_header` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.send_header`, but no assignment to it exists in __init__ (and no class-level fallb…

[MINED108] `self.send_header` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.send_header`, but no assignment to it exists in __init__ (and no class-level fallb…

[MINED108] `self.send_header` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.send_header`, but no assignment to it exists in __init__ (and no class-level fallb…

[MINED108] `self.send_header` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.send_header`, but no assignment to it exists in __init__ (and no class-level fallb…

[MINED108] `self.send_header` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.send_header`, but no assignment to it exists in __init__ (and no class-level fallb…

[MINED108] `self.send_response` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.send_response`, but no assignment to it exists in __init__ (and no class-level f…

[MINED108] `self.send_header` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.send_header`, but no assignment to it exists in __init__ (and no class-level fallb…

[MINED108] `self.path` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.path`, but no assignment to it exists in __init__ (and no class-level fallback). This rai…

[MINED108] `self._format` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self._format`, but no assignment to it exists in __init__ (and no class-level fallback). Th…

[MINED108] `self.headers` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.headers`, but no assignment to it exists in __init__ (and no class-level fallback). Th…

[MINED108] `self.send_header` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.send_header`, but no assignment to it exists in __init__ (and no class-level fallb…

[MINED108] `self.send_header` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.send_header`, but no assignment to it exists in __init__ (and no class-level fallb…

[MINED108] `self.end_headers` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.end_headers`, but no assignment to it exists in __init__ (and no class-level fallb…

[MINED108] `self.wfile` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.wfile`, but no assignment to it exists in __init__ (and no class-level fallback). This r…

[MINED108] `self.wfile` used but never assigned in __init__: Method `do_GET` of class `ReqHandler` reads `self.wfile`, but no assignment to it exists in __init__ (and no class-level fallback). This r…

[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…

[MINED118] Dockerfile FROM `python:3` not pinned by digest: `FROM python:3` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially …

[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…

[SEC103] LDAP injection — non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts.

[SEC103] LDAP injection — non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts.

[SEC103] LDAP injection — non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts.

[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…

Docker final stage has no non-root USER

Docker build context has no .dockerignore

[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.

[ERR002] Empty Catch Block: Empty catch blocks hide errors.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED124] requirements.txt: `pcapy-ng` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats…

[SEC012] ZipSlip — Archive Path Traversal: Archive extraction without path validation allows writing files outside the target directory.

[SEC123] Production stack trace / debug output exposed: Debug mode left on in production exposes stack traces, environment variables, framework internals — sometimes triggers RCE (Django debug page w…

Duplicated implementation block across source files

Duplicated implementation block across source files

[COMP001] High cognitive complexity: Function `expand_range` has cognitive complexity 12 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested…

[COMP001] High cognitive complexity: Function `write` has cognitive complexity 8 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branche…

Compose service does not declare a runtime user

Compose service lacks no-new-privileges hardening

[SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template liter…

[COMP001] High cognitive complexity (and 23 more): Same pattern found in 23 additional files. Review if needed.

[MINED043] Http Not Https (and 2 more): Same pattern found in 2 additional files. Review if needed.

[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.

[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.

[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.

[MINED050] Stub Only Function (and 2 more): Same pattern found in 2 additional files. Review if needed.

[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.

[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.

[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.

[MINED072] Python Pass Only Class: class Foo: pass — stub waiting to be filled in.