GuardDog

Import GuardDog reports in JSON format. GuardDog inspects PyPI and npm packages for indicators of malicious behaviour, using Semgrep rules over the package source plus metadata heuristics.

Generate a report with:

guarddog pypi scan <package-or-path> --output-format json > guarddog.json

Severity Mapping#

GuardDog’s rules fall into two families. A threat-* rule describes behaviour that is suspicious in a package; a capability-* rule records that the package is able to do something, which is an observation rather than an accusation.

Where GuardDog’s risk engine correlates a rule into a scored risk, that risk carries its own severity on GuardDog’s low/medium/high scale, and it takes precedence:

The package-level risk_score (no_risks_detected, low, suspicious, high_risk) is recorded in each Finding’s description rather than mapped onto severity, since it describes the package as a whole rather than the individual match.

GuardDog reports every rule it ran, including the ones that did not match; only rules with at least one match are imported.

Sample Scan Data#

Sample GuardDog scans can be found here.

Default Deduplication Hashcode Fields#

By default, DefectDojo identifies duplicate Findings using these hashcode fields:

• vuln_id_from_tool
• component_name
• file_path
• line