Malware detection

Vulnetix finds malware in two ways, and they answer different questions.

	vulnetix malscan	Known-malicious gate
Question	Is there malicious code or behaviour in the bytes installed on this machine?	Is any resolved dependency a release Vulnetix already knows is malicious?
Input	Installed dependency directories: node_modules, .venv, vendor, caches	The dependency list from your manifests and lockfiles
Runs	On your machine, with malscan-engine compiled into the CLI	A lookup against the Vulnetix VDB
Turned on by	vulnetix malscan, or the malscan pass of vulnetix scan	--fail-on malware on scan or sca
Finds	Install-script payloads, embedded C2 hosts, known-bad file hashes, persistence tricks	Packages already reported, including ones whose payload is fetched later

Run both: the gate catches what is known, and malscan catches what is in front of you.

What vulnetix malscan does

vulnetix malscan

1. Resolves the scan root: --path or the positional argument as given, otherwise the enclosing git root.
2. Finds the dependency install directories under it for eleven ecosystems (JavaScript, Python, Conda, Go, Rust, Ruby, PHP, Java, .NET, Dart, Elixir), and with --include-home the per-user caches, or with --include-system the whole machine. See Scan targets.
3. Runs four detector families over each directory:
   • iocscan: every file is matched against known-bad domains, IPs and URLs from the Vulnetix STIX feeds, TweetFeed and the badnet blocklists. Binaries are reduced to printable strings first.
   • detect: the manifest and install scripts of each installed package go through the pattern rules, the shell-obfuscation analyser and the behavioural detectors.
   • ioc: indicators (hosts, URLs, wallets, install commands) are extracted from a package judged malicious.
   • badhash: hashes declared in a package’s manifest are checked against the known-bad hash list.
4. Classes every finding as evidence, trigger or context (Detection model). One evidence finding makes the package malicious.
5. Drops findings covered by your ignore rules and indicators the community has marked false positive.
6. Writes .vulnetix/malscan.sarif, updates .vulnetix/memory.yaml, uploads when you are authenticated, prints the report, and exits 1 if any package is malicious.

The engine version is fixed by the CLI’s go.mod: cli@2449840 ships malscan-engine v0.6.1. The engine’s own repository is ahead of that, and its newer rules reach you only with a CLI release that moves the pin.

Inside scan and sca

Command	malscan pass	Fails on malware when
vulnetix scan	Runs by default. --no-malscan skips it.	--fail-on malware, or the organisation’s quality gate sets blockMalware
vulnetix sca	Runs only when malware gating is on	--fail-on malware, or the organisation’s blockMalware
vulnetix malscan	Always	Always: any malicious package exits 1

With the gate on, scan and sca fail on both the VDB’s known-malicious verdict and any locally detected malware. A scan without the gate still records a malscan snapshot.

Curation in the console

Malware findings, advisories and indicators show in the console at Malware. Any signed-in member can mark a package version, advisory, finding, indicator or threat actor that their organisation has encountered as a false positive, or confirm it, and can add the organisation’s own indicators. One organisation’s false positive on a package version or an indicator clears it for every Vulnetix customer: the package firewall stops blocking it, and vulnetix malscan stops reporting a cleared indicator the next time it can reach Vulnetix. Curation and indicators has the rules.

Find the page for your task

I want to	Read
Scan a project and gate CI on it	Quickstart
Understand evidence, trigger and context	Detection model
Scan home caches, a whole machine or a container	Scan targets
Refresh indicators offline or from my own feeds	Threat-intel definitions
Mark a false positive or add my own IOC	Curation and indicators
Silence one finding locally	Suppressing findings
Look up a rule id such as P-CURL-PIPE	Detectors and Pattern rules
Read the SARIF or JSON	Output and exit codes

GitHub Actions

Run it in a workflow with the malscan GitHub Action: it writes malscan.sarif after your dependency install, keeps it as an artifact and attests it.

Platform IaC

Whether scan and sca fail on malware can come from the organisation’s quality gate (blockMalware in QualityGate). The package firewall’s malware blocking is PackageFirewallPolicy. The organisation’s own indicators of compromise are MalwareIoc documents, which leave scanner-found and feed indicators alone. See the kind catalogue.

When Drift protection is on, a change made in the console or through a legacy API to a malware indicator that is managed as code (by Terraform or a repository) is refused with HTTP 409 managed_by_platform_iac. Change it where it is declared, or ask an admin to turn Drift protection off.