CLI reference

malware-detector <command> [options]     # or the short alias: mdetect
malware-detector --version

scan

Scan source files and directories for malicious behaviour.

malware-detector scan [path ...] [options]

Argument / option	Description
path ...	Files or directories to scan. Default: .. With --staged/--changed, the first path is the git repo.
--staged	Scan only git-staged files (pre-commit).
--changed	Scan only files changed vs HEAD, plus untracked files (pre-push).
--include-deps	Also scan dependency/build directories that are skipped by default.
--with-malcontent	Also run malcontent (YARA). Needs the mal binary: brew install malcontent. Full scans only.

deps

Scan a package for supply-chain risk with GuardDog.

malware-detector deps <path> [options]

Argument / option	Description
path	Package directory or archive.
--ecosystem {npm,pypi}	Package ecosystem. Default: npm if package.json is present, else pypi.

Shared options

These options work with both scan and deps:

Option	Default	Description
--json		Output JSON. Can't be combined with --sarif.
--sarif		Output SARIF 2.1.0.
--min-severity {MEDIUM,HIGH,CRITICAL}	MEDIUM	Only show findings at or above this level.
--fail-on {MEDIUM,HIGH,CRITICAL}	MEDIUM	Exit 1 if any finding (shown or not) is at or above this level.
--ignore-file PATH	auto	Suppression file. Default: nearest .malware-detector-ignore.json upward.
--explain		Show the detecting engine and matched source line for each finding.

Exit codes

Code	Meaning
0	No findings at or above --fail-on
1	Findings at or above --fail-on
2	Usage error (bad flag, not a git repo, malformed ignore file)
3	Engine error (engine missing or failed)