Flags

vulnetix malscan [path] [flags]

[path] is the same as --path. Either one is used exactly as given. With neither, the scan root is the current directory’s git root, or the current directory outside a repository.

What to scan

Flag	Type	Default	Effect
--path	string	.	Directory whose install directories are scanned.
--include-home	bool	false	Also scan the per-user caches (~/.npm, ~/go/pkg/mod, ~/.cargo, ~/.m2 and others). See Scan targets.
--include-system	bool	false	Scan the whole machine: system install locations, every account’s caches, and /usr/bin, /opt and the other binary directories.
--system-root	string	/	The filesystem --include-system describes: a mounted volume, an unpacked image, /proc/<pid>/root.
--scan-depth	int	0	Directory depth inside each target. 0 is unlimited.
--max-file-size	int	10485760	Skip files larger than this many bytes in the IOC scan (10 MiB).
--no-binary-analysis	bool	false	Do not extract strings from binary files for the IOC scan.
--no-ioc-feeds	bool	false	Skip the IOC scan entirely (no download, no STIX or badnet matching). detect and badhash still run.
--catalog	string		Directory of capability override files (<slug>.json). Sets MALSCAN_CONFIG_DIR for the run. See Detectors.

Definitions

Flag	Type	Default	Effect
--fetch-definitions	bool	false	Refresh the badnet blocklists, the Vulnetix STIX index and TweetFeed, then exit without scanning.
--feeds	string		A feeds.json that replaces the default badnet feed list for --fetch-definitions. An error without it. See Threat-intel definitions.

Output

Flag	Type	Default	Effect
-o, --output	string	pretty	What stdout gets: pretty (alias table), json or sarif. Anything else is an error. The SARIF file is written whatever you choose.
--output-file	string	<path>/.vulnetix/malscan.sarif	Where the SARIF file is written. A name not ending .sarif gets a warning.
--no-upload	bool	false	Do not submit findings to Vulnetix even when authenticated.
--disable-memory	bool	false	Do not record findings in .vulnetix/memory.yaml or write the OpenVEX file.
-v, --verbose	count		Show every finding on its own row instead of one row per line.

-o here is a single format for stdout, not the repeatable target list of vulnetix scan.

Global flags

--org-id, --no-banner, --no-progress, --no-analytics, --silent.

Environment variables

Variable	Effect
VULNETIX_MALSCAN_DEFS_DIR	Directory for the badnet definitions overlay. Default <user cache>/vulnetix/malscan/definitions.
MALSCAN_CONFIG_DIR	Directory of capability override files. Default <user config>/malscan-engine. --catalog sets it.

Malware flags on scan and sca

Flag	Command	Effect
--fail-on malware	scan, sca	Exit 1 when a dependency is a known malicious release in the VDB, or the malscan pass finds a malicious package. On sca it also turns the malscan pass on.
--no-malscan	scan, sca	Skip the malscan pass. The VDB lookup still runs.
--block-malware	scan, sca	Superseded spelling of --fail-on malware. Hidden from help, still accepted.

The organisation’s quality gate can set blockMalware, which applies to scan and sca as if --fail-on malware were passed.