Scanning code

scan checks source files for malicious behaviour. It covers JavaScript, TypeScript, Python and PHP, plus package.json install hooks.

malware-detector scan [path ...] [options]

Common recipes

malware-detector scan                         # current directory
malware-detector scan src tests               # several paths
malware-detector scan app/uploads/shell.php   # a single file
malware-detector scan . --explain             # show engine + matched line
malware-detector scan . --min-severity HIGH   # strongest signals only
malware-detector scan . --json > report.json  # machine-readable
malware-detector scan . --sarif > out.sarif   # for code-scanning dashboards

Only scan what changed

Full scans are thorough. Incremental scans are what keep git hooks fast:

malware-detector scan --staged      # files staged for commit (pre-commit)
malware-detector scan --changed     # changed vs HEAD + untracked files (pre-push)

With --staged or --changed, the first path is the git repository to inspect (default: current directory). If nothing relevant changed, the scan exits 0 immediately.

See Git hooks to wire these up.

What gets skipped by default

To keep the report focused on code you own, these are skipped:

Kind	Patterns
Version control	.git
Python envs & caches	.venv, venv, env, site-packages, .tox, __pycache__, *.egg-info, …
Node dependencies	node_modules, .pnpm, .yarn
Build output	dist, build, out, target, .next, .nuxt, .svelte-kit
Vendored code	vendor
Minified bundles	*.min.js, *.min.css, *.bundle.js

Scan dependencies too

Supply-chain attacks live in exactly those skipped folders. To include them:

malware-detector scan . --include-deps

TIP

Expect more findings and a slower scan with --include-deps. Many legitimate libraries use eval, child_process or pickle. Start with --min-severity HIGH and widen from there. To vet a single package in depth, use deps instead.

Maximum coverage: add malcontent

malcontent adds YARA-based detection for binaries, archives and heavily obfuscated webshells. On the benchmark, it raises recall from 73% to 91%.

brew install malcontent                       # one-time; standalone Go binary
malware-detector scan . --with-malcontent

INFO

--with-malcontent works with full scans. It isn't used in --staged / --changed mode, so hooks stay fast.

Choosing a threshold

Two flags control what you see and what fails the run. They are independent:

Flag	Controls	Default
--min-severity	which findings are shown	MEDIUM
--fail-on	which findings make the exit code 1	MEDIUM

A common CI setup shows everything and only blocks on strong signals:

malware-detector scan . --fail-on HIGH

More on results and exit codes →