malware-detector

Appearance

Git hooks ​

The cheapest place to stop malicious code is before it enters your history. Hooks scan only the files you're committing, so they finish in seconds.

Add this to .pre-commit-config.yaml in your repository:

yaml
repos:
  - repo: https://github.com/benzid-wael/malware-detector
    rev: v0.1.0 # pin to a release tag
    hooks:
      - id: malware-detector

Then install the hook:

sh
pre-commit install

From now on, every git commit scans the staged JavaScript, TypeScript, Python and PHP files. If anything at or above MEDIUM is found, the commit is blocked and the report is printed.

Pass extra flags with args, for example to block only on strong signals:

yaml
      - id: malware-detector
        args: [--fail-on, HIGH]

TIP

pre-commit builds its own environment for the hook. Make sure a Python 3.10–3.13 interpreter is available, for example with default_language_version: { python: python3.13 } in your config.

With a plain git hook ​

If you don't use the pre-commit framework, use a two-line hook. It needs malware-detector on your PATH; see Get started.

sh
# .git/hooks/pre-commit  (chmod +x)
#!/bin/sh
exec malware-detector scan --staged

To also scan before pushing, covering everything that changed since HEAD, including untracked files:

sh
# .git/hooks/pre-push  (chmod +x)
#!/bin/sh
exec malware-detector scan --changed

With Husky (JavaScript projects) ​

sh
# .husky/pre-commit
malware-detector scan --staged

When the hook blocks you ​

  1. Read the finding. Add --explain (run the command by hand) to see the matched line.
  2. If it's real, don't commit it. Remove the code and find out where it came from.
  3. If it's a false positive, add a narrow entry with a reason to .malware-detector-ignore.json, and commit that file too.

Avoid git commit --no-verify. It skips the scan for everyone who follows that habit.