malware-detector

Appearance

FAQ & troubleshooting ​

General ​

Does my code leave my machine? ​

No. All engines run locally (or on your CI runner) and there is no telemetry. The Docker image works with --network none.

Is it free? ​

Yes. It is MIT-licensed open source.

How is this different from npm audit or Dependabot? ​

Those tools match your dependencies against a database of known, published vulnerabilities. malware-detector looks at what code does, so it can flag malware that nobody has reported yet, including in your own repository. Use both. Full comparison →

Which languages are supported? ​

JavaScript, TypeScript (including JSX/TSX), Python and PHP, plus package.json install hooks. deps covers npm and PyPI packages.

How accurate is it? ​

Every change is checked against a labelled benchmark in CI. On a real-world corpus of 95 malicious samples, the full hybrid setup catches 91% at the default gate, and the HIGH gate has no false positives on trusted packages. See the benchmark →

What happens if a file can't be parsed? ​

You get a finding for it: engine-partial-parse for the lines that were skipped, or engine-scan-failed if the whole file couldn't be analysed. An attacker could deliberately write code a scanner can't read, so this is never treated as clean. More →

Which engines does it use? ​

Semgrep and built-in heuristics for scan, GuardDog for deps, and optionally malcontent. Engines →

Troubleshooting ​

error: scan engine not found … Is semgrep installed? ​

The engines are installed alongside malware-detector. This error usually means it was installed in a way that left them out, for example with --no-deps. Reinstall:

sh
uv tool install --force malware-detector-py

Installation fails on Python 3.14 ​

GuardDog depends on pygit2, which has no Python 3.14 build yet. Install with Python 3.13:

sh
uv tool install --python 3.13 malware-detector-py

--with-malcontent fails ​

malcontent is an optional, separate binary. Install it with brew install malcontent. Installing it with go install usually fails because it needs native YARA libraries.

Too many findings on a big project ​

  1. Make sure you aren't scanning dependencies on purpose (--include-deps is off by default).
  2. Use --min-severity HIGH to focus on the strongest signals first.
  3. Record reviewed false positives in the ignore file.

The scan exits with code 2 ​

This is a usage problem, not a finding. Common causes are a malformed .malware-detector-ignore.json, or --staged / --changed run outside a git repository. The error message says which one.

I think it missed something, or flagged something it shouldn't ​

Please open an issue with a minimal (and defanged) sample. Missed detections and false positives become benchmark cases, so the fix stays fixed.