Output and exit codes

Files written

Path	When	Contents
.vulnetix/malscan.sarif (or --output-file)	Every scan, clean or not	SARIF 2.1.0, one result per finding
.vulnetix/memory.yaml	Unless --disable-memory	Each finding’s state. A finding the engine no longer reports is marked resolved.
.vulnetix/vex-malscan.openvex.json	When a finding changed state, unless --disable-memory	OpenVEX statements attesting the resolved findings

The .vulnetix/ directory is under the resolved scan root, never the current directory.

SARIF

Field	Value
ruleId	The detector’s id: IOC-STIX-MATCH, P-CURL-PIPE, IS-G-PIPE, PY-SETUP-CRED-EXFIL, B-KNOWN-BAD-HASH … See Detectors.
level	error for evidence, warning for trigger, note for context
Severity	critical for evidence (an IOC hit takes the indicator’s severity), medium for trigger, low for context
Location	File relative to the scan root, and the line when the matched text can be found in it. A file outside the root is named by its base name.
Snippet	The matched line, or for an IOC hit the line with three lines either side. Without a line, the message carries Matched: <text>.
CWE	From the engine’s signal-to-CWE map, else CWE-506 (Embedded Malicious Code)
Tags	malware, the class, and the category (install, pkgbuild, gtfobins, shell, behavioral, ioc, the indicator type)
Rule kind	malware

runs[0].properties holds scanRoot, host (hostname, OS, architecture, PID, scan time), filesScanned, indicatorCount, malicious, warnings, and git (branch, commit, remotes, dirty, repoRoot).

Terminal and stdout

-o	stdout
pretty (default), table	The report grouped by package: MALICIOUS, SUSPICIOUS, CHECKED, NOT CHECKED
json	{"host", "malicious", "filesScanned", "indicatorCount", "findings", "iocs", "warnings", "targets"}. Each finding’s keys are the CLI’s field names (RuleID, Severity, Class, File, StartLine, Snippet, IOCType, IOCValue, Package, …). Each IOC is {"type", "value", "ecosystem", "file", "references", "sampleSha256"}.
sarif	The same SARIF document that is written to the file

The terminal view never changes the file, the upload or the exit code.

What is uploaded

Nothing without credentials, and nothing with --no-upload. When authenticated, the CLI sends POST /v2/cli.malscan:

Part	Detail
Findings	Every finding, in chunks of at most 2,000, with the SARIF document. Stored as a MALWARE scanner run with findings, triage and OpenVEX, visible in the console.
Indicators	Up to 200 extracted IOCs (type, value, ecosystem, file, rule, severity, STIX references), stored as MalwareIoc rows with source vulnetix-cli-malscan, scoped to your organisation.
Samples	For an indicator found in a file, the file itself (first 1 MiB) with its SHA-256, at most 4 MiB in total per run. Stored in object storage and linked to the IOC.
Host	Hostname, OS, architecture and PID, and the git context.

The ioc family extracts indicators only from packages judged malicious. Every IOC-scan hit is also sent as an indicator with its file sample, including hits demoted to context (a known-bad host in a dependency’s test fixture), so a run with no malicious package can still upload samples.

Exit codes

Code	Meaning
0	No package is malicious. Also returned for an INCOMPLETE scan and after --fetch-definitions.
1	At least one package has an evidence finding (after ignore rules and curation), or a fatal error such as an invalid -o, or --fetch-definitions could fetch no feed.

The breach message is quality gate(s) breached: malscan: N malware findings (<packages>).