Skip to content

Bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.4 - #671

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github/codeql-action/upload-sarif-4.37.4
Open

Bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.4#671
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github/codeql-action/upload-sarif-4.37.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Contributor

Bumps github/codeql-action/upload-sarif from 4.37.3 to 4.37.4.

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.37.4

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
  • Update default CodeQL bundle version to 2.26.2. #4051
Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.5 - 03 Aug 2026

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
  • Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
  • Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

  • Update default CodeQL bundle version to 2.26.0. #3995
  • In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

  • Cache CodeQL CLI version information across Actions steps. #3943
  • Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
  • Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

... (truncated)

Commits
  • f205ea1 Merge pull request #4053 from github/update-v4.37.4-9130ce0f7
  • e40d079 Update changelog for v4.37.4
  • 9130ce0 Merge pull request #4051 from github/update-bundle/codeql-bundle-v2.26.2
  • c62d824 Add changelog note
  • da0c190 Update default bundle to codeql-bundle-v2.26.2
  • 18420e3 Merge pull request #4043 from github/mbg/ts/changelog
  • 7e8d897 Merge pull request #4046 from github/mbg/repo-prop/code-quality
  • 2d4c474 Log !analysisKindSupported case
  • 98c05a1 Fix argument validation in rollback-changelog.ts
  • 8289a49 Ignore repository property for unsupported analysis kinds
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.4
3eaf6b8 
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.3 to 4.37.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@e4fba86...f205ea1)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code patch Patch semver labels Aug 3, 2026
@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

Deleted: /tmp/prior-commit ∴ /tmp/prior-commit/.github/workflows/script/bundle_changelog.py [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
-LOW 3P/guarddog/capability_filesystem_read Detects filesystem read capabilities, by GuardDog Team, Datadog open('CHANGELOG.md', 'r
.read(
-LOW exec/imports/python imports python modules import os
import re
-LOW fs/file/open opens files open(
-LOW fs/file/write writes to a file open('CHANGELOG.md', 'w')
-LOW fs/path/usr_bin path reference within /usr/bin /usr/bin/env
-LOW net/url/embedded contains embedded HTTPS URLs https://github.com/github/codeql-action/releases/tag/codeql-bundle-v
-LOW os/env/get Retrieve environment variable values os.environ
-LOW os/fd/read reads from a file handle f.read()
-LOW os/fd/write writes to a file handle f.write(changelog)

Deleted: /tmp/prior-commit ∴ /tmp/prior-commit/.github/workflows/script/prepare_changelog.py [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
-LOW 3P/guarddog/capability_filesystem_read Detects filesystem read capabilities, by GuardDog Team, Datadog .readlines(
-LOW exec/imports/python imports python modules import sys
import os
-LOW fs/file/exists check if a file exists path.exists
-LOW fs/file/open opens files open(
-LOW fs/file/read opens a file for read open(changelog_file, 'r')
-LOW fs/path/usr_bin path reference within /usr/bin /usr/bin/env

Deleted: /tmp/prior-commit ∴ /tmp/prior-commit/.github/workflows/script/rollback_changelog.py [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
-LOW 3P/guarddog/capability_filesystem_read Detects filesystem read capabilities, by GuardDog Team, Datadog open('CHANGELOG.md', 'r
.readlines(
-LOW exec/imports/python imports python modules import argparse
import datetime
import os
-LOW fs/file/exists check if a file exists path.exists
-LOW fs/file/open opens files open(

Deleted: /tmp/prior-commit ∴ /tmp/prior-commit/node_modules/tsx/dist/index-D9F1FXzN.cjs [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
-MEDIUM data/encoding/utf16 assembles strings from UTF-16 code units ,String.fromCharCode(55296+(
,String.fromCharCode(r)}retu
:String.fromCharCode(s)}}h(b
=String.fromCharCode(s[r]);r
?String.fromCharCode(r):(r-=
String.fromCharCode(xe(2));
-MEDIUM exec/program executes external program exec(u)[0].length;return Math.min(p,c)
exec(u);)g.push(p)
exec(s)
require
-MEDIUM net/ip/host_port connects to an arbitrary host:port host,r.port=c.port
host=c.host,r.port
host+r.port
host:r,port
-LOW 3P/guarddog/capability_filesystem_delete Detects file/directory deletion capabilities, by GuardDog Team, Datadog .unlink(
-LOW 3P/guarddog/capability_network_outbound Detects network request capabilities (HTTP, sockets, etc.), by GuardDog Team, Datadog resolve(
-LOW 3P/guarddog/capability_process_spawn Detects process execution and spawning, by GuardDog Team, Datadog exec(s
exec(u
-LOW data/encoding/base64 Supports base64 encoded strings base64
-LOW data/encoding/int parses integers parseInt(
-LOW data/encoding/json_decode Decodes JSON messages JSON.parse
-LOW data/encoding/json_encode encodes JSON JSON.stringify
-LOW fs/directory/create creates directories mkdir
-LOW fs/directory/remove Uses libc functions to remove directories rmdir
-LOW fs/file/delete deletes files unlink
-LOW fs/file/write writes to file writeFile
-LOW net/http Uses the HTTP protocol http
-LOW net/url/embedded contains embedded HTTPS URLs https://github.com/rich-harris/magic-string
-LOW net/url/parse Handles URL strings new URL
-LOW os/env/get Retrieve environment variable values env.TSX_DISABLE_CACH
env.NODE_V
-LOW os/fd/write writes to a file handle e.write(Vt)
e.write(er)

Deleted: /tmp/prior-commit ∴ /tmp/prior-commit/node_modules/tsx/dist/index-XurvG3JN.mjs [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
-MEDIUM data/encoding/utf16 assembles strings from UTF-16 code units ,String.fromCharCode(55296+(
,String.fromCharCode(r)}retu
:String.fromCharCode(s)}}h(k
=String.fromCharCode(s[r]);r
?String.fromCharCode(r):(r-=
String.fromCharCode(xe(2));
-MEDIUM net/ip/host_port connects to an arbitrary host:port host,r.port=c.port
host=c.host,r.port
host+r.port
host:r,port
-LOW 3P/guarddog/capability_filesystem_delete Detects file/directory deletion capabilities, by GuardDog Team, Datadog .unlink(
-LOW 3P/guarddog/capability_process_spawn Detects process execution and spawning, by GuardDog Team, Datadog exec(s
exec(u
-LOW data/encoding/base64 Supports base64 encoded strings base64
-LOW data/encoding/int parses integers parseInt(
-LOW data/encoding/json_decode Decodes JSON messages JSON.parse
-LOW data/encoding/json_encode encodes JSON JSON.stringify
-LOW fs/directory/create creates directories mkdir
-LOW fs/directory/remove Uses libc functions to remove directories rmdir
-LOW fs/file/delete deletes files unlink
-LOW fs/file/write writes to file writeFile
-LOW net/http Uses the HTTP protocol http
-LOW net/url/embedded contains embedded HTTPS URLs https://github.com/rich-harris/magic-string
-LOW net/url/parse Handles URL strings new URL
-LOW os/env/get Retrieve environment variable values env.TSX_DISABLE_CACH
env.NODE_V
-LOW os/fd/write writes to a file handle e.write(ir)
e.write(nr)

Deleted: /tmp/prior-commit ∴ /tmp/prior-commit/node_modules/tsx/dist/register-BLUABhh3.cjs [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
-MEDIUM data/encoding/utf16 assembles strings from UTF-16 code units =String.fromCharCode(l),l===
=String.fromCharCode(l),l=e.
=String.fromCharCode(l),n++,
=String.fromCharCode(x):f=4;
-MEDIUM exec/program executes external program exec(e);return t?Number(t[1])
require
-LOW 3P/guarddog/capability_network_outbound Detects network request capabilities (HTTP, sockets, etc.), by GuardDog Team, Datadog resolve(
-LOW 3P/guarddog/capability_process_spawn Detects process execution and spawning, by GuardDog Team, Datadog exec(e
-LOW data/encoding/base64 Supports base64 encoded strings base64
-LOW data/encoding/json_decode Decodes JSON messages JSON.parse
-LOW data/encoding/json_encode encodes JSON JSON.stringify
-LOW fs/file/write writes to file writeFileSync
-LOW net/url/parse Handles URL strings new URL
-LOW os/env/get Retrieve environment variable values env.TSX_TSCONFIG_PAT
env.TSX_DEBUG

Deleted: /tmp/prior-commit ∴ /tmp/prior-commit/node_modules/tsx/dist/register-CN6UEFH9.cjs [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
-MEDIUM fs/path/relative references and possibly executes relative path ./esm
-LOW data/encoding/json_decode Decodes JSON messages JSON.parse
-LOW data/encoding/json_encode encodes JSON JSON.stringify
-LOW fs/file/read reads files ReadFile
-LOW net/url/parse Handles URL strings new URL
-LOW os/env/get Retrieve environment variable values env.TSX_TSCONFIG_PAT
env.NODE_OPTIONS

Deleted: /tmp/prior-commit ∴ /tmp/prior-commit/node_modules/tsx/dist/register-D5KIhaFJ.mjs [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
-MEDIUM fs/path/relative references and possibly executes relative path ./esm
-LOW data/encoding/json_decode Decodes JSON messages JSON.parse
-LOW data/encoding/json_encode encodes JSON JSON.stringify
-LOW net/url/parse Handles URL strings new URL
-LOW os/env/get Retrieve environment variable values env.TSX_TSCONFIG_PAT
env.NODE_OPTIONS

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/@actions/artifact/node_modules/brace-expansion/dist/commonjs/index.js [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM anti-static/obfuscation/math complex math with parseInt or fromCharCode conversions (CVE-2026-14257)
fromCharCode
(need + 1)
[a-zA-Z]
parseInt
+MEDIUM data/encoding/utf16 assembles strings from UTF-16 code units String.fromCharCode(i)
+MEDIUM impact/exploit/cve Mentions a recent CVE CVE-2026-14257
+LOW anti-behavior/random_behavior uses a random number generator random
+LOW data/encoding/int parses integers parseInt(

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/@actions/artifact/node_modules/brace-expansion/dist/commonjs/index.js.map [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM data/encoding/utf16 assembles strings from UTF-16 code units String.fromCharCode(i)\n
+MEDIUM impact/exploit/cve Mentions a recent CVE CVE-2026-14257
+LOW anti-behavior/random_behavior uses a random number generator random
+LOW data/encoding/int parses integers parseInt(

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/@actions/artifact/node_modules/brace-expansion/dist/esm/index.js [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM anti-static/obfuscation/math complex math with parseInt or fromCharCode conversions (CVE-2026-14257)
fromCharCode
(need + 1)
[a-zA-Z]
parseInt
+MEDIUM data/encoding/utf16 assembles strings from UTF-16 code units String.fromCharCode(i)
+MEDIUM impact/exploit/cve Mentions a recent CVE CVE-2026-14257
+LOW anti-behavior/random_behavior uses a random number generator random
+LOW data/encoding/int parses integers parseInt(

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/@actions/artifact/node_modules/brace-expansion/dist/esm/index.js.map [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM data/encoding/utf16 assembles strings from UTF-16 code units String.fromCharCode(i)\n
+MEDIUM impact/exploit/cve Mentions a recent CVE CVE-2026-14257
+LOW anti-behavior/random_behavior uses a random number generator random
+LOW data/encoding/int parses integers parseInt(

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/@typescript-eslint/typescript-estree/dist/getImportClausePhaseModifier.js [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM fs/path/relative references and possibly executes relative path ./version-check

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/brace-expansion/dist/commonjs/index.js [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM anti-static/obfuscation/math complex math with parseInt or fromCharCode conversions (CVE-2026-14257)
fromCharCode
(need + 1)
[a-zA-Z]
parseInt
+MEDIUM data/encoding/utf16 assembles strings from UTF-16 code units String.fromCharCode(i)
+MEDIUM impact/exploit/cve Mentions a recent CVE CVE-2026-14257
+LOW anti-behavior/random_behavior uses a random number generator random
+LOW data/encoding/int parses integers parseInt(

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/brace-expansion/dist/commonjs/index.js.map [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM data/encoding/utf16 assembles strings from UTF-16 code units String.fromCharCode(i)\n
+MEDIUM impact/exploit/cve Mentions a recent CVE CVE-2026-14257
+LOW anti-behavior/random_behavior uses a random number generator random
+LOW data/encoding/int parses integers parseInt(

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/brace-expansion/dist/esm/index.js [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM anti-static/obfuscation/math complex math with parseInt or fromCharCode conversions (CVE-2026-14257)
fromCharCode
(need + 1)
[a-zA-Z]
parseInt
+MEDIUM data/encoding/utf16 assembles strings from UTF-16 code units String.fromCharCode(i)
+MEDIUM impact/exploit/cve Mentions a recent CVE CVE-2026-14257
+LOW anti-behavior/random_behavior uses a random number generator random
+LOW data/encoding/int parses integers parseInt(

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/brace-expansion/dist/esm/index.js.map [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM data/encoding/utf16 assembles strings from UTF-16 code units String.fromCharCode(i)\n
+MEDIUM impact/exploit/cve Mentions a recent CVE CVE-2026-14257
+LOW anti-behavior/random_behavior uses a random number generator random
+LOW data/encoding/int parses integers parseInt(

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/@eslint/eslintrc/conf/config-schema.js [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
+LOW exec/plugin references a 'plugin' plugins

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/@eslint/eslintrc/dist/eslintrc-universal.cjs [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM exec/program executes external program exec(fullname)
require
+LOW 3P/guarddog/capability_process_spawn Detects process execution and spawning, by GuardDog Team, Datadog exec(f
+LOW c2/tool_transfer/os references a specific operating system https://
Windows
http://
+LOW data/encoding/json_encode encodes JSON JSON.stringify
+LOW exec/plugin references a 'plugin' Common helpers for naming of plugins
const getPluginRule
const getPluginEnv
pluginEnvironments
pluginProcessors
pluginRules
+LOW net/http Uses the HTTP protocol http
+LOW net/url/embedded contains embedded HTTPS URLs https://github.com/eslint/eslint/issues/5644

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/@eslint/eslintrc/dist/eslintrc.cjs [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM data/encoding/yaml Unsafe decoding of YAML content (can execute arbitrary code) yaml.load(
+MEDIUM discover/system/platform get system identification process.platform
+LOW 3P/guarddog/capability_network_outbound Detects network request capabilities (HTTP, sockets, etc.), by GuardDog Team, Datadog resolve(
+LOW 3P/guarddog/capability_process_spawn Detects process execution and spawning, by GuardDog Team, Datadog exec(f
+LOW c2/tool_transfer/os references a specific operating system https://
Windows
http://
+LOW data/encoding/json_decode Decodes JSON messages JSON.parse
+LOW data/encoding/json_encode encodes JSON JSON.stringify
+LOW exec/plugin references a 'plugin' A path to the directory that plugins should
path the the directory that plugins should
config objects representing the plugins
if the environment comes from a plugin
it should come after the plugin config
Common helpers for naming of plugins
class is to store parsers or plugins
expresses a loaded parser or plugin
The processor name to refer plugin
cannot use a file path for plugins
The base path to resolve plugins
Whitespace found in plugin name
The map for additional plugins
plugins The resolved plugins
plugins The plugin loaders
_loadExtendedPluginConfig
on the additional plugins
option as a pseudo plugin
Normalize a given plugin
additionalPluginPool The
function normalizePlugin
const normalizedPlugins
must come after plugins
name The plugin name to
return normalizedPlugin
with the plugins in the
pluginId The plugin ID
Failed to load plugin
The normalized plugin
function mergePlugins
Get the plugin rules
const pluginBasePath
let normalizedPlugin
Load a given plugin
PluginConflictError
Translating plugins
const getPluginRule
Load given plugins
const getPluginEnv
pluginEnvironments
The loaded plugin
translate plugins
Resolving plugin
The plugin rules
const pluginName
pluginDefinition
pluginProcessors
DependentPlugin
get pluginRules
Loading plugin
Merge plugins
const plugins
_loadPlugins
plugins from
throw plugin
and plugins
pluginList
addPlugin
+LOW net/http Uses the HTTP protocol http
+LOW net/url/embedded contains embedded HTTPS URLs https://github.com/eslint/eslint/issues/5644
https://github.com/mysticatea

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/@eslint/eslintrc/dist/eslintrc.cjs.map [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM data/encoding/yaml Unsafe decoding of YAML content (can execute arbitrary code) yaml.load(
+MEDIUM discover/system/platform get system identification process.platform
+MEDIUM discover/user/info returns user info for the current process os.homedir
+LOW 3P/guarddog/capability_filesystem_read Detects filesystem read capabilities, by GuardDog Team, Datadog fs.readFile
+LOW 3P/guarddog/capability_network_outbound Detects network request capabilities (HTTP, sockets, etc.), by GuardDog Team, Datadog resolve(
+LOW 3P/guarddog/capability_process_spawn Detects process execution and spawning, by GuardDog Team, Datadog exec(f
+LOW c2/tool_transfer/os references a specific operating system https://
Windows
http://
+LOW data/encoding/json_decode Decodes JSON messages JSON.parse
+LOW data/encoding/json_encode encodes JSON JSON.stringify
+LOW exec/plugin references a 'plugin' A path to the directory that plugins should
path the the directory that plugins should
config objects representing the plugins
if the environment comes from a plugin
it should come after the plugin config
Common helpers for naming of plugins
class is to store parsers or plugins
expresses a loaded parser or plugin
The processor name to refer plugin
cannot use a file path for plugins
n additionalPluginPool
The base path to resolve plugins
n return normalizedPlugin
Whitespace found in plugin name
n pluginName
The map for additional plugins
n _loadExtendedPluginConfig
n additionalPluginPool
n const getPluginRule
n return normalizedPlugin
plugins The resolved plugins
n const getPluginEnv
plugins The plugin loaders
n const plugin
n const pluginName
n const pluginBasePath
n let normalizedPlugin
nfunction normalizePlugin
on the additional plugins
option as a pseudo plugin
Normalize a given plugin
additionalPluginPool The
n plugins
nconst normalizedPlugins
must come after plugins
name The plugin name to
with the plugins in the
n const plugins
n normalizedPlugins
nfunction mergePlugins
pluginId The plugin ID
Failed to load plugin
The normalized plugin
n mergePlugins
n throw plugin
Get the plugin rules
n plugins
n get pluginRules
Load a given plugin
PluginConflictError
Translating plugins
Load given plugins
pluginEnvironments
The loaded plugin
n _loadPlugins
translate plugins
Resolving plugin
The plugin rules
pluginDefinition
pluginProcessors
DependentPlugin
Loading plugin
Merge plugins
n plugins
plugins from
and plugins
pluginList
addPlugin
+LOW fs/file/read reads files fs.readFile
+LOW fs/file/stat access filesystem metadata fs.statSync(ctx.filePath).isFile())
+LOW net/http Uses the HTTP protocol http
+LOW net/url/embedded contains embedded HTTPS URLs https://github.com/eslint/eslint/issues/5644
https://github.com/mysticatea

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/@eslint/eslintrc/lib/cascading-config-array-factory.js [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM discover/user/info returns user info for the current process os.homedir
+MEDIUM fs/path/relative references and possibly executes relative path ./config-array
./shared
+LOW 3P/guarddog/capability_network_outbound Detects network request capabilities (HTTP, sockets, etc.), by GuardDog Team, Datadog resolve(
+LOW exec/plugin references a 'plugin' The map for additional plugins
on the additional plugins
option as a pseudo plugin
additionalPluginPool
addPlugin
+LOW net/url/embedded contains embedded HTTPS URLs https://github.com/mysticatea

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/@eslint/eslintrc/lib/config-array-factory.js [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM data/encoding/yaml Unsafe decoding of YAML content (can execute arbitrary code) yaml.load(
+MEDIUM fs/path/relative references and possibly executes relative path ./config-array
./shared
+LOW 3P/guarddog/capability_filesystem_read Detects filesystem read capabilities, by GuardDog Team, Datadog fs.readFile
+LOW 3P/guarddog/capability_network_outbound Detects network request capabilities (HTTP, sockets, etc.), by GuardDog Team, Datadog resolve(
+LOW data/encoding/json_decode Decodes JSON messages JSON.parse
+LOW exec/plugin references a 'plugin' A path to the directory that plugins should
path the the directory that plugins should
cannot use a file path for plugins
The base path to resolve plugins
Whitespace found in plugin name
The map for additional plugins
_loadExtendedPluginConfig
Normalize a given plugin
additionalPluginPool The
function normalizePlugin
const normalizedPlugins
name The plugin name to
return normalizedPlugin
Failed to load plugin
The normalized plugin
const pluginBasePath
let normalizedPlugin
Load a given plugin
Load given plugins
The loaded plugin
const pluginName
pluginDefinition
DependentPlugin
Loading plugin
const plugins
_loadPlugins
throw plugin
pluginList
pluginId
+LOW fs/file/read reads files fs.readFile
+LOW fs/file/stat access filesystem metadata fs.statSync(ctx.filePath).isFile())
+LOW net/url/embedded contains embedded HTTPS URLs https://github.com/mysticatea

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/@eslint/eslintrc/lib/config-array/config-array.js [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
+LOW exec/plugin references a 'plugin' The processor name to refer plugin
plugins The resolved plugins
plugins The plugin loaders
with the plugins in the
pluginId The plugin ID
function mergePlugins
Get the plugin rules
PluginConflictError
pluginEnvironments
The plugin rules
pluginProcessors
DependentPlugin
get pluginRules
Merge plugins
const plugin
and plugins
+LOW net/url/embedded contains embedded HTTPS URLs https://github.com/mysticatea

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/@eslint/eslintrc/lib/config-array/config-dependency.js [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
+LOW data/encoding/json_encode encodes JSON JSON.stringify
+LOW exec/plugin references a 'plugin' class is to store parsers or plugins
expresses a loaded parser or plugin
DependentPlugin
+LOW net/url/embedded contains embedded HTTPS URLs https://github.com/mysticatea

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/@eslint/eslintrc/lib/config-array/extracted-config.js [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
+LOW exec/plugin references a 'plugin' DependentPlugin
plugins
+LOW net/url/embedded contains embedded HTTPS URLs https://github.com/mysticatea

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/@eslint/eslintrc/lib/config-array/ignore-pattern.js [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM discover/system/platform get system identification process.platform
+LOW c2/tool_transfer/os references a specific operating system https://
Windows
+LOW net/url/embedded contains embedded HTTPS URLs https://github.com/mysticatea

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/@eslint/eslintrc/lib/config-array/index.js [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM fs/path/relative references and possibly executes relative path ./extracted-config
./override-tester
./ignore-pattern
./config-array
+LOW net/url/embedded contains embedded HTTPS URLs https://github.com/mysticatea

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/@eslint/eslintrc/lib/config-array/override-tester.js [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
+LOW net/url/embedded contains embedded HTTPS URLs https://github.com/mysticatea

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/@eslint/eslintrc/lib/flat-compat.js [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
+LOW exec/plugin references a 'plugin' config objects representing the plugins
if the environment comes from a plugin
it should come after the plugin config
must come after plugins
Translating plugins
pluginEnvironments
translate plugins
Resolving plugin
pluginProcessors
plugins from
pluginName

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/@eslint/eslintrc/lib/shared/ajv.js [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
+LOW net/http Uses the HTTP protocol http
+LOW net/url/embedded contains embedded HTTP URLs http://json-schema.org/draft-04/schema

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/@eslint/eslintrc/lib/shared/config-validator.js [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
+LOW data/encoding/json_encode encodes JSON JSON.stringify
+LOW exec/plugin references a 'plugin' const getPluginRule
const getPluginEnv
pluginEnvironments
pluginProcessors
pluginRules

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/@eslint/eslintrc/lib/shared/deprecation-warnings.js [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
+LOW data/encoding/json_encode encodes JSON JSON.stringify
+LOW net/http Uses the HTTP protocol http
+LOW net/url/embedded contains embedded HTTP URLs http://github.com/mysticatea

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/@eslint/eslintrc/lib/shared/naming.js [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
+LOW 3P/guarddog/capability_process_spawn Detects process execution and spawning, by GuardDog Team, Datadog exec(f
+LOW c2/tool_transfer/os references a specific operating system https://
Windows
+LOW exec/plugin references a 'plugin' Common helpers for naming of plugins
+LOW net/url/embedded contains embedded HTTPS URLs https://github.com/eslint/eslint/issues/5644

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/@eslint/eslintrc/lib/shared/relative-module-resolver.js [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
+LOW 3P/guarddog/capability_network_outbound Detects network request capabilities (HTTP, sockets, etc.), by GuardDog Team, Datadog resolve(

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/@eslint/eslintrc/lib/shared/types.js [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
+LOW exec/plugin references a 'plugin' The definition of plugin configs
The definition of plugin rules
plugins
Plugin
+LOW net/url/embedded contains embedded HTTPS URLs https://github.com/mysticatea

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/@eslint/eslintrc/lib/types/index.d.ts [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
+LOW exec/plugin references a 'plugin' config objects representing the plugins

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/@eslint/eslintrc/package.json [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM fs/path/relative references and possibly executes relative path ./universal
./package
./dist
./lib
+LOW 3P/guarddog/capability_process_hooks Detects install hooks that can execute code during package installation, by GuardDog Team, Datadog
+LOW net/url/embedded contains embedded HTTPS URLs https://github.com/eslint/eslintrc/issues
https://opencollective.com/eslint

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/@eslint/eslintrc/universal.js [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM fs/path/relative references and possibly executes relative path ./dist

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/globals/index.d.ts [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM data/encoding/url decodes URL components decodeURIComponent
+MEDIUM exec/cmd executes a command runCommand
+MEDIUM exec/script/activex Create an ActiveX object ActiveXObject
+MEDIUM exec/script/wsh Accesses a Windows Scripting Host (WSH) object WScript
+MEDIUM exec/shell/command run a command runCommand
+MEDIUM fs/permission/modify modifies file permissions chmod
+MEDIUM net/download download files GM_download
+MEDIUM net/http/websocket supports web sockets WebSocket
+MEDIUM net/webrtc makes outgoing WebRTC connections RTCPeerConnection
+LOW anti-behavior/random_behavior uses a random number generator Random
+LOW data/random/insecure generate random numbers insecurely _rand
+LOW discover/process/working_directory gets current working directory 'pwd'
+LOW exec/plugin references a 'plugin' PluginArray
+LOW fs/directory/create creates directories mkdir
+LOW net/http Uses the HTTP protocol HTTP
+LOW net/http/request makes HTTP requests httpRequest

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/globals/index.js [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM fs/path/relative references and possibly executes relative path ./globals

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/globals/package.json [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
+LOW 3P/guarddog/capability_process_hooks Detects install hooks that can execute code during package installation, by GuardDog Team, Datadog
+LOW net/url/embedded contains embedded HTTPS URLs https://github.com/sponsors/sindresorhus
https://sindresorhus.com

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/js-yaml/bin/js-yaml.js [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
+LOW 3P/guarddog/capability_filesystem_read Detects filesystem read capabilities, by GuardDog Team, Datadog fs.readFile
+LOW data/encoding/json_decode Decodes JSON messages JSON.parse
+LOW data/encoding/json_encode encodes JSON JSON.stringify
+LOW data/encoding/yaml Decodes YAML content yaml.load
+LOW fs/file/read reads files fs.readFile
+LOW fs/path/usr_bin path reference within /usr/bin /usr/bin/env

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/js-yaml/dist/js-yaml.js [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM anti-static/obfuscation/math complex math with parseInt or fromCharCode conversions var CHAR_BOM = 65279;
charAt
+MEDIUM data/encoding/int performs math directly against parsed integers * parseInt(
+MEDIUM data/encoding/url decodes URL components decodeURIComponent
+MEDIUM data/encoding/utf16 assembles strings from UTF-16 code units String.fromCharCode((c - 65
String.fromCharCode(c)
+MEDIUM exec/shell/pipe_sh pipes to shell [
+LOW 3P/guarddog/capability_network_outbound Detects network request capabilities (HTTP, sockets, etc.), by GuardDog Team, Datadog resolve(
+LOW 3P/guarddog/capability_process_spawn Detects process execution and spawning, by GuardDog Team, Datadog exec(a
exec(d
exec(l
exec(m
exec(s
+LOW data/encoding/yaml Decodes YAML content yaml.load
+LOW net/resolve/hostname resolve network host name to IP address cannot resolve

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/js-yaml/dist/js-yaml.js.map [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM anti-static/obfuscation/hex many references to hexadecimal values 0xFFFFFFFF
0x00007E
0x00D7FF
0x00FFFD
0x010000
0x10FFFF
0x00020
0x000A1
0x0E000
0x10000
0x03FF
0x2028
0x2029
0xD800
0xDBFF
0xDC00
0xDFFF
0xFEFF
0x400
0x07
0x08
0x09
0x0A
0x0B
0x0C
0x0D
0x1B
0x21
0x22
0x23
0x25
0x26
0x27
0x2A
0x2B
0x2C
0x2D
0x2E
0x2F
0x30
0x37
0x39
0x3A
0x3C
0x3D
0x3E
0x3F
0x41
0x46
0x4C
0x4E
0x50
0x55
0x5B
0x5C
0x5D
0x5F
0x60
0x61
0x62
0x65
0x66
0x6E
0x72
0x74
0x75
0x76
0x78
0x7B
0x7C
0x7D
0x85
0xA0
\x00
\x07
\x08
\x09
\x0A
\x0B
\x0C
\x0D
\x0E
\x1B
\x1F
\x22
\x5C
\x7F
\x84
\x85
\x86
\x9F
\xA0
+MEDIUM data/encoding/int performs math directly against parsed integers * parseInt(
+MEDIUM data/encoding/url decodes URL components decodeURIComponent
+MEDIUM data/encoding/utf16 assembles strings from UTF-16 code units point","fromCharCode","setPr
String.fromCharCode(\n (
String.fromCharCode(c)\n }
+LOW c2/tool_transfer/arch references a specific architecture https://
http://
x86
+LOW net/http Uses the HTTP protocol http
+LOW net/resolve/hostname resolve network host name to IP address cannot resolve
+LOW net/url/embedded contains embedded HTTPS URLs https://mathiasbynens.be/notes/javascript-encoding
https://github.com/nodeca/js-yaml/issues/164
https://en.wikipedia.org/wiki/UTF-16

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/js-yaml/dist/js-yaml.min.js [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM anti-static/obfuscation/math complex math with parseInt or fromCharCode conversions [0-9A-Za-z-]
fromCharCode
56320+65536
(r-55296)
[0-9a-f]
parseInt
e-65536
n-56320
[0-9_]
(a+1)
(i/2)
(t+1)
(t+2)
97+10
[++a]
[0-9]
[c+g]
[c-d]
[k+1]
[r+1]
e-48
t-97
+MEDIUM data/encoding/int performs math directly against parsed integers *parseInt(
+MEDIUM data/encoding/url decodes URL components decodeURIComponent
+MEDIUM data/encoding/utf16 assembles strings from UTF-16 code units :String.fromCharCode(55296+(
?String.fromCharCode(e):Stri
+LOW 3P/guarddog/capability_network_outbound Detects network request capabilities (HTTP, sockets, etc.), by GuardDog Team, Datadog resolve(
+LOW 3P/guarddog/capability_process_spawn Detects process execution and spawning, by GuardDog Team, Datadog exec(e
exec(n
exec(r
+LOW net/resolve/hostname resolve network host name to IP address cannot resolve

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/js-yaml/dist/js-yaml.min.js.map [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM anti-static/obfuscation/hex many references to hexadecimal values 0xFFFFFFFF
0x00007E
0x00D7FF
0x00FFFD
0x010000
0x10FFFF
0x00020
0x000A1
0x0E000
0x10000
0x03FF
0x2028
0x2029
0xD800
0xDBFF
0xDC00
0xDFFF
0xFEFF
0x400
0x07
0x08
0x09
0x0A
0x0B
0x0C
0x0D
0x1B
0x21
0x22
0x23
0x25
0x26
0x27
0x2A
0x2B
0x2C
0x2D
0x2E
0x2F
0x30
0x37
0x39
0x3A
0x3C
0x3D
0x3E
0x3F
0x41
0x46
0x4C
0x4E
0x50
0x55
0x5B
0x5C
0x5D
0x5F
0x60
0x61
0x62
0x65
0x66
0x6E
0x72
0x74
0x75
0x76
0x78
0x7B
0x7C
0x7D
0x85
0xA0
\x00
\x07
\x08
\x09
\x0A
\x0B
\x0C
\x0D
\x0E
\x1B
\x1F
\x22
\x5C
\x7F
\x84
\x85
\x86
\x9F
\xA0
+MEDIUM data/encoding/int performs math directly against parsed integers * parseInt(
+MEDIUM data/encoding/url decodes URL components decodeURIComponent
+MEDIUM data/encoding/utf16 assembles strings from UTF-16 code units point","fromCharCode","setPr
String.fromCharCode(\n (
String.fromCharCode(c)\n }
+LOW c2/tool_transfer/arch references a specific architecture https://
http://
x86
+LOW net/http Uses the HTTP protocol http
+LOW net/resolve/hostname resolve network host name to IP address cannot resolve
+LOW net/url/embedded contains embedded HTTPS URLs https://mathiasbynens.be/notes/javascript-encoding
https://github.com/nodeca/js-yaml/issues/164
https://en.wikipedia.org/wiki/UTF-16

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/js-yaml/dist/js-yaml.mjs.map [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM anti-static/obfuscation/hex many references to hexadecimal values 0xFFFFFFFF
0x00007E
0x00D7FF
0x00FFFD
0x010000
0x10FFFF
0x00020
0x000A1
0x0E000
0x10000
0x03FF
0x2028
0x2029
0xD800
0xDBFF
0xDC00
0xDFFF
0xFEFF
0x400
0x07
0x08
0x09
0x0A
0x0B
0x0C
0x0D
0x1B
0x21
0x22
0x23
0x25
0x26
0x27
0x2A
0x2B
0x2C
0x2D
0x2E
0x2F
0x30
0x37
0x39
0x3A
0x3C
0x3D
0x3E
0x3F
0x41
0x46
0x4C
0x4E
0x50
0x55
0x5B
0x5C
0x5D
0x5F
0x60
0x61
0x62
0x65
0x66
0x6E
0x72
0x74
0x75
0x76
0x78
0x7B
0x7C
0x7D
0x85
0xA0
\x00
\x07
\x08
\x09
\x0A
\x0B
\x0C
\x0D
\x0E
\x1B
\x1F
\x22
\x5C
\x7F
\x84
\x85
\x86
\x9F
\xA0
+MEDIUM anti-static/obfuscation/math complex math with parseInt or fromCharCode conversions (tzHour * 60 + tzMinute)
[previousLineBreak + 1]
(more-indented lines)
(or lineWidth is -1)
(maxLineLength / 2)
[foundLineNo + i]
[foundLineNo - i]
(first - 0xD800)
uestions/8458984
(_position + 1)
(_position + 2)
(c - 0x010000)
[0-9A-Za-z-]
fromCharCode
(curr + 1)
issues/164
(pos + 1)
[++index]
[0-9a-f]
parseInt
[i + 1]
5e-100
UTF-16
[0-9_]
[ */)
[0-9]
+MEDIUM data/encoding/int performs math directly against parsed integers * parseInt(
+MEDIUM data/encoding/url decodes URL components decodeURIComponent
+MEDIUM data/encoding/utf16 assembles strings from UTF-16 code units String.fromCharCode(\n (
String.fromCharCode(c)\n }
+LOW 3P/guarddog/capability_network_outbound Detects network request capabilities (HTTP, sockets, etc.), by GuardDog Team, Datadog resolve(
+LOW 3P/guarddog/capability_process_spawn Detects process execution and spawning, by GuardDog Team, Datadog exec(a
exec(d
exec(l
exec(m
exec(s
+LOW c2/tool_transfer/arch references a specific architecture https://
http://
x86
+LOW net/http Uses the HTTP protocol http
+LOW net/resolve/hostname resolve network host name to IP address cannot resolve
+LOW net/url/embedded contains embedded HTTPS URLs https://mathiasbynens.be/notes/javascript-encoding
https://github.com/nodeca/js-yaml/issues/164
https://en.wikipedia.org/wiki/UTF-16

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/js-yaml/index.js [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM fs/path/relative references and possibly executes relative path ./lib

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/js-yaml/lib/dumper.js [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM anti-static/obfuscation/hex many references to hexadecimal values 0xFFFFFFFF
0x00007E
0x00D7FF
0x00FFFD
0x10FFFF
0x00020
0x000A1
0x0E000
0x10000
0x2028
0x2029
0xD800
0xDBFF
0xDC00
0xDFFF
0xFEFF
0x400
0x07
0x08
0x09
0x0A
0x0B
0x0C
0x0D
0x1B
0x21
0x22
0x23
0x25
0x26
0x27
0x2A
0x2C
0x2D
0x3A
0x3D
0x3E
0x3F
0x5B
0x5C
0x5D
0x60
0x7B
0x7C
0x7D
0x85
0xA0
+MEDIUM exec/program executes external program exec(string)))
exec(line)))
require
+MEDIUM fs/path/relative references and possibly executes relative path ./exception
./common
./schema
+LOW 3P/guarddog/capability_network_outbound Detects network request capabilities (HTTP, sockets, etc.), by GuardDog Team, Datadog resolve(
+LOW 3P/guarddog/capability_process_spawn Detects process execution and spawning, by GuardDog Team, Datadog exec(l
exec(s
+LOW net/url/embedded contains embedded HTTPS URLs https://mathiasbynens.be/notes/javascript-encoding

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/js-yaml/lib/exception.js [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
+LOW net/http Uses the HTTP protocol http
+LOW net/url/embedded contains embedded HTTP URLs http://stackoverflow.com/questions/8458984

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/js-yaml/lib/index_vite_proxy.tmp.mjs [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
+LOW exec/imports/python imports python modules import yaml

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/js-yaml/lib/loader.js [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM anti-static/obfuscation/hex many references to hexadecimal values 0x010000
0x10FFFF
0x03FF
0xD800
0xDC00
0xFEFF
0xFFFF
0x09
0x0A
0x0D
0x20
0x21
0x22
0x23
0x25
0x26
0x27
0x2A
0x2B
0x2C
0x2D
0x2E
0x2F
0x30
0x39
0x3A
0x3C
0x3E
0x3F
0x40
0x4C
0x4E
0x50
0x55
0x5B
0x5C
0x5D
0x5F
0x60
0x61
0x62
0x65
0x66
0x6E
0x72
0x74
0x75
0x76
0x78
0x7B
0x7C
0x7D
\x00
\x07
\x08
\x09
\x0A
\x0B
\x0C
\x0D
\x0E
\x1B
\x1F
\x22
\x5C
\x7F
\x84
\x85
\x86
\x9F
\xA0
+MEDIUM anti-static/obfuscation/math complex math with parseInt or fromCharCode conversions (more-indented lines)
(_position + 1)
(_position + 2)
(c - 0x010000)
[0-9A-Za-z-]
fromCharCode
issues/164
[0-9a-f]
parseInt
UTF-16
[ */)
[0-9]
+MEDIUM data/encoding/url decodes URL components decodeURIComponent
+MEDIUM data/encoding/utf16 assembles strings from UTF-16 code units String.fromCharCode(c
+MEDIUM exec/program executes external program exec(args[0])
require
+MEDIUM fs/path/relative references and possibly executes relative path ./exception
./snippet
./common
./schema
+LOW 3P/guarddog/capability_network_outbound Detects network request capabilities (HTTP, sockets, etc.), by GuardDog Team, Datadog resolve(
+LOW 3P/guarddog/capability_process_spawn Detects process execution and spawning, by GuardDog Team, Datadog exec(a
+LOW c2/tool_transfer/arch references a specific architecture https://
http://
x86
+LOW data/encoding/int parses integers parseInt(
+LOW net/http Uses the HTTP protocol http
+LOW net/resolve/hostname resolve network host name to IP address cannot resolve
+LOW net/url/embedded contains embedded HTTPS URLs https://github.com/nodeca/js-yaml/issues/164
https://en.wikipedia.org/wiki/UTF-16

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/js-yaml/lib/schema.js [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM fs/path/relative references and possibly executes relative path ./exception
./type

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/js-yaml/lib/schema/core.js [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM fs/path/relative references and possibly executes relative path ./json
+LOW net/http Uses the HTTP protocol http
+LOW net/url/embedded contains embedded HTTP URLs http://www.yaml.org/spec/1.2/spec.html

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/js-yaml/lib/schema/default.js [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
+LOW net/http Uses the HTTP protocol http
+LOW net/url/embedded contains embedded HTTP URLs http://yaml.org/type/

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/js-yaml/lib/schema/failsafe.js [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
+LOW net/http Uses the HTTP protocol http
+LOW net/url/embedded contains embedded HTTP URLs http://www.yaml.org/spec/1.2/spec.html

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/js-yaml/lib/schema/json.js [🔵 LOW]

RISK KEY DESCRIPTION EVIDENCE
+LOW net/http Uses the HTTP protocol http
+LOW net/url/embedded contains embedded HTTP URLs http://www.yaml.org/spec/1.2/spec.html

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/js-yaml/lib/snippet.js [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM exec/program executes external program exec(mark.buffer)))
require
+MEDIUM fs/path/relative references and possibly executes relative path ./common
+LOW 3P/guarddog/capability_process_spawn Detects process execution and spawning, by GuardDog Team, Datadog exec(m

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/js-yaml/lib/type.js [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM fs/path/relative references and possibly executes relative path ./exception

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/js-yaml/lib/type/int.js [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM anti-static/obfuscation/math complex math with parseInt or fromCharCode conversions [++index]
parseInt
+MEDIUM data/encoding/int performs math directly against parsed integers * parseInt(

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/js-yaml/lib/type/timestamp.js [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM exec/program executes external program exec(data) !== null)
require
+LOW 3P/guarddog/capability_process_spawn Detects process execution and spawning, by GuardDog Team, Datadog exec(d

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/eslint/node_modules/js-yaml/package.json [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM fs/path/relative references and possibly executes relative path ./package
./index
./dist
+LOW 3P/guarddog/capability_process_hooks Detects install hooks that can execute code during package installation, by GuardDog Team, Datadog
+LOW exec/plugin references a 'plugin' plugin
+LOW net/http Uses the HTTP protocol http
+LOW net/url/embedded contains embedded HTTPS URLs https://github.com/sponsors/nodeca
https://github.com/sponsors/puzrin
https://github.com/puzrin

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/tsx/dist/cli.cjs [🛑 HIGH]

RISK KEY DESCRIPTION EVIDENCE
+HIGH exfil/stealer/file Accesses Ofice documents, encrypts and archives numbers
pages
docm
docx
glob
ppam
xlsx
mov
pdf
ppt
rtf
+MEDIUM c2/tool_transfer/os references multiple operating systems https://
Windows
windows
darwin
Linux
linux
+MEDIUM data/encoding/utf16 assembles strings from UTF-16 code units =String.fromCharCode(e);retu
=String.fromCharCode(t);if(t
>String.fromCharCode(c)),s=`
+MEDIUM exfil/office_file_ext References multiple Office file extensions (possible exfil) docm
docx
ppam
xlsx
ppt
+MEDIUM fs/path/relative references and possibly executes relative path ./patch-repl
./preflight
./loader
+MEDIUM process/create create child process require("child_process")
+LOW 3P/guarddog/capability_network_outbound Detects network request capabilities (HTTP, sockets, etc.), by GuardDog Team, Datadog resolve(
+LOW 3P/guarddog/capability_process_spawn Detects process execution and spawning, by GuardDog Team, Datadog require("child_process")
exec(D
exec(e
exec(t
exec(u
exec(y
spawn(
+LOW data/compression/bzip2 Works with bzip2 files bzip2
+LOW data/compression/gzip works with gzip files gzip
+LOW data/compression/lzma works with lzma files lzma
+LOW data/encoding/int parses integers parseInt(
+LOW data/encoding/json_decode Decodes JSON messages JSON.parse
+LOW data/encoding/json_encode encodes JSON JSON.stringify
+LOW fs/directory/create creates directories mkdir
+LOW fs/file/delete deletes files unlink
+LOW fs/symlink_resolve resolves symbolic links realpath
+LOW net/url/embedded contains embedded HTTPS URLs https://github.com/jonschlinkert/normalize-path
https://github.com/micromatch/to-regex-range
https://github.com/jonschlinkert/fill-range
https://github.com/jonschlinkert/is-extglob
https://github.com/jonschlinkert/is-number
https://github.com/jonschlinkert/is-glob
+LOW os/env/get Retrieve environment variable values env.CHOKIDAR_INTERVA
env.CHOKIDAR_PRINT_F
env.CHOKIDAR_USEPOLL
env.PATHEXT
env.OSTYPE
+LOW os/fd/write writes to a file handle stdout.write(Fl)

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/tsx/dist/index-BN2t1Mfo.cjs [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM data/encoding/utf16 assembles strings from UTF-16 code units ,String.fromCharCode(55296+(
,String.fromCharCode(n)}retu
:String.fromCharCode(s)}}f(p
=String.fromCharCode(s[n]);r
?String.fromCharCode(n):(n-=
String.fromCharCode(Ee(2));
+MEDIUM exec/program executes external program exec(u)[0].length;return Math.min(p,c)
exec(u);)g.push(p)
exec(s)
require
+MEDIUM net/ip/host_port connects to an arbitrary host:port host,n.port=c.port
host=c.host,n.port
host+n.port
host:n,port
+LOW 3P/guarddog/capability_filesystem_delete Detects file/directory deletion capabilities, by GuardDog Team, Datadog .unlink(
+LOW 3P/guarddog/capability_network_outbound Detects network request capabilities (HTTP, sockets, etc.), by GuardDog Team, Datadog resolve(
+LOW 3P/guarddog/capability_process_spawn Detects process execution and spawning, by GuardDog Team, Datadog exec(i
exec(s
exec(u
+LOW data/encoding/base64 Supports base64 encoded strings base64
+LOW data/encoding/int parses integers parseInt(
+LOW data/encoding/json_decode Decodes JSON messages JSON.parse
+LOW data/encoding/json_encode encodes JSON JSON.stringify
+LOW fs/directory/create creates directories mkdir
+LOW fs/directory/remove Uses libc functions to remove directories rmdir
+LOW fs/file/delete deletes files unlink
+LOW fs/file/write writes to file writeFile
+LOW net/http Uses the HTTP protocol http
+LOW net/url/embedded contains embedded HTTPS URLs https://github.com/rich-harris/magic-string
+LOW net/url/parse Handles URL strings new URL
+LOW os/env/get Retrieve environment variable values env.TSX_DISABLE_CACH
env.NODE_V
+LOW os/fd/write writes to a file handle e.write(Vt)
e.write(en)

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/tsx/dist/index-CQhDiIsg.mjs [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM data/encoding/utf16 assembles strings from UTF-16 code units ,String.fromCharCode(55296+(
,String.fromCharCode(n)}retu
:String.fromCharCode(s)}}l(C
=String.fromCharCode(s[n]);r
?String.fromCharCode(n):(n-=
String.fromCharCode(Ee(2));
+MEDIUM net/ip/host_port connects to an arbitrary host:port host,n.port=c.port
host=c.host,n.port
host+n.port
host:n,port
+LOW 3P/guarddog/capability_filesystem_delete Detects file/directory deletion capabilities, by GuardDog Team, Datadog .unlink(
+LOW 3P/guarddog/capability_process_spawn Detects process execution and spawning, by GuardDog Team, Datadog exec(i
exec(s
exec(u
+LOW data/encoding/base64 Supports base64 encoded strings base64
+LOW data/encoding/int parses integers parseInt(
+LOW data/encoding/json_decode Decodes JSON messages JSON.parse
+LOW data/encoding/json_encode encodes JSON JSON.stringify
+LOW fs/directory/create creates directories mkdir
+LOW fs/directory/remove Uses libc functions to remove directories rmdir
+LOW fs/file/delete deletes files unlink
+LOW fs/file/write writes to file writeFile
+LOW net/http Uses the HTTP protocol http
+LOW net/url/embedded contains embedded HTTPS URLs https://github.com/rich-harris/magic-string
+LOW net/url/parse Handles URL strings new URL
+LOW os/env/get Retrieve environment variable values env.TSX_DISABLE_CACH
env.NODE_V
+LOW os/fd/write writes to a file handle e.write(rn)
e.write(sn)

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/tsx/dist/register-BoI6-WNn.cjs [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM data/encoding/utf16 assembles strings from UTF-16 code units =String.fromCharCode(l),l===
=String.fromCharCode(l),l=e.
=String.fromCharCode(l),n++,
=String.fromCharCode(x):f=4;
+MEDIUM exec/program executes external program exec(e);return t?Number(t[1])
require
+LOW 3P/guarddog/capability_network_outbound Detects network request capabilities (HTTP, sockets, etc.), by GuardDog Team, Datadog resolve(
+LOW 3P/guarddog/capability_process_spawn Detects process execution and spawning, by GuardDog Team, Datadog exec(e
+LOW data/encoding/base64 Supports base64 encoded strings base64
+LOW data/encoding/json_decode Decodes JSON messages JSON.parse
+LOW data/encoding/json_encode encodes JSON JSON.stringify
+LOW fs/file/write writes to file writeFileSync
+LOW net/url/parse Handles URL strings new URL
+LOW os/env/get Retrieve environment variable values env.TSX_TSCONFIG_PAT
env.TSX_DEBUG

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/tsx/dist/register-DlUHyDDv.cjs [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM fs/path/relative references and possibly executes relative path ./esm
+LOW data/encoding/json_decode Decodes JSON messages JSON.parse
+LOW data/encoding/json_encode encodes JSON JSON.stringify
+LOW fs/file/read reads files ReadFile
+LOW net/url/parse Handles URL strings new URL
+LOW os/env/get Retrieve environment variable values env.TSX_TSCONFIG_PAT
env.NODE_OPTIONS

Added: /tmp/current-commit ∴ /tmp/current-commit/node_modules/tsx/dist/register-zZ7SWseA.mjs [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM fs/path/relative references and possibly executes relative path ./esm
+LOW data/encoding/json_decode Decodes JSON messages JSON.parse
+LOW data/encoding/json_encode encodes JSON JSON.stringify
+LOW net/url/parse Handles URL strings new URL
+LOW os/env/get Retrieve environment variable values env.TSX_TSCONFIG_PAT
env.NODE_OPTIONS

Added: /tmp/current-commit ∴ /tmp/current-commit/pr-checks/bundle-changelog.test.ts [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM fs/path/relative references and possibly executes relative path ./bundle-changelog
./changelog
+LOW 3P/guarddog/capability_filesystem_delete Detects file/directory deletion capabilities, by GuardDog Team, Datadog fs.rmSync(
+LOW net/url/embedded contains embedded HTTPS URLs https://github.com/github/codeql-action/pulls/42

Added: /tmp/current-commit ∴ /tmp/current-commit/pr-checks/bundle-changelog.ts [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM fs/path/relative references and possibly executes relative path ./changelog
./config
./util
+LOW 3P/guarddog/capability_filesystem_read Detects filesystem read capabilities, by GuardDog Team, Datadog fs.readFile
+LOW data/encoding/int parses integers parseInt(
+LOW fs/file/read reads files fs.readFile
+LOW fs/file/write writes to file writeFileSync
+LOW fs/path/usr_bin path reference within /usr/bin /usr/bin/env

Added: /tmp/current-commit ∴ /tmp/current-commit/pr-checks/prepare-changelog.test.ts [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM fs/path/relative references and possibly executes relative path ./changelog
+LOW 3P/guarddog/capability_filesystem_delete Detects file/directory deletion capabilities, by GuardDog Team, Datadog fs.rmSync(
+LOW fs/file/write writes to file writeFileSync

Added: /tmp/current-commit ∴ /tmp/current-commit/pr-checks/prepare-changelog.ts [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM fs/path/relative references and possibly executes relative path ./changelog
./config
./util
+LOW 3P/guarddog/capability_filesystem_read Detects filesystem read capabilities, by GuardDog Team, Datadog fs.readFile
+LOW fs/file/read reads files fs.readFile
+LOW fs/file/write writes to file writeFileSync
+LOW fs/path/usr_bin path reference within /usr/bin /usr/bin/env

Added: /tmp/current-commit ∴ /tmp/current-commit/pr-checks/rollback-changelog.test.ts [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM fs/path/relative references and possibly executes relative path ./changelog
./config
+LOW 3P/guarddog/capability_filesystem_read Detects filesystem read capabilities, by GuardDog Team, Datadog fs.readFile
+LOW fs/file/read reads files fs.readFile

Added: /tmp/current-commit ∴ /tmp/current-commit/pr-checks/rollback-changelog.ts [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM fs/path/relative references and possibly executes relative path ./changelog
./config
./util
+LOW 3P/guarddog/capability_filesystem_read Detects filesystem read capabilities, by GuardDog Team, Datadog fs.readFile
+LOW fs/file/read reads files fs.readFile
+LOW fs/path/usr_bin path reference within /usr/bin /usr/bin/env

Added: /tmp/current-commit ∴ /tmp/current-commit/src/tools-download.test.ts [🟡 MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM c2/tool_transfer/download accesses hardcoded archive file endpoint https://example.com/codeql-bundle.tar
+MEDIUM fs/path/relative references and possibly executes relative path ./tools-download
./testing-utils
./logging
./util
./tar
+MEDIUM net/download download files await downloadAndExtract
downloadAndExtract omits
const downloadTool
downloadDurationMs
tools-download
+LOW c2/tool_transfer/os references a specific operating system https://
linux
+LOW data/compression/gzip works with gzip files gzip
+LOW data/compression/zstd Zstandard: fast real-time compression algorithm zstd
+LOW net/url/embedded contains embedded HTTPS URLs https://example.com/codeql-bundle.tar.zst
https://example.com/codeql-bundle.tar.gz

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code patch Patch semver

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants