malware-detector

Appearance

Docker (offline) ​

The Docker image includes Python 3.13 and the core engines, so you don't need a local install. It is the safest way to inspect code you don't trust:

  • It runs as a non-root user.
  • Your code is mounted read-only.
  • No network access is needed. Add --network none to make sure of it.
sh
docker pull ghcr.io/benzid-wael/malware-detector:latest

Usage ​

The image runs malware-detector scan . by default, with /scan as the working directory:

sh
# Scan the current directory
docker run --rm --network none -v "$PWD:/scan:ro" ghcr.io/benzid-wael/malware-detector

# Any subcommand and flags work
docker run --rm --network none -v "$PWD:/scan:ro" ghcr.io/benzid-wael/malware-detector scan . --explain
docker run --rm --network none -v "$PWD:/scan:ro" ghcr.io/benzid-wael/malware-detector deps .

# Write SARIF to the host
docker run --rm --network none -v "$PWD:/scan:ro" ghcr.io/benzid-wael/malware-detector \
  scan . --sarif > results.sarif

Pin a version tag (e.g. :0.1.0) instead of :latest in CI so results are reproducible.

Build it yourself ​

sh
git clone https://github.com/benzid-wael/malware-detector
docker build -t malware-detector malware-detector
docker run --rm -v "$PWD:/scan:ro" malware-detector

INFO

malcontent (--with-malcontent) is a separate Go binary and isn't included in the image.