Scan targets

malscan scans dependency install directories, not your source tree. Only directories that exist are scanned. A vendor/, target/ or build/ directory is claimed by the ecosystem whose manifest sits beside it, so it is never scanned twice.

Project directories

Always scanned, under the resolved scan root. The root is --path or the positional argument as given; without either, the current directory’s git root.

Ecosystem	Directories	Only when the root holds
JavaScript (npm, pnpm, Yarn, Bun)	node_modules, .yarn/cache, .yarn/unplugged, .pnpm-store
Python	.venv, venv, env, .tox, __pypackages__
Conda	envs, .conda	environment.yml or environment.yaml
Go	vendor	go.mod
Rust	vendor, target	Cargo.toml
Ruby	vendor/bundle, .bundle
PHP	vendor	composer.json
Java	target	pom.xml
Java	build	build.gradle or build.gradle.kts
.NET	packages	*.sln, *.csproj or packages.config
Dart	.dart_tool
Elixir	deps, _build	mix.exs

Home caches (--include-home)

Off by default because these caches are shared by every project on the machine, so a finding there is not specific to the one you are scanning.

Ecosystem	Directories
JavaScript	$npm_config_cache or ~/.npm, ~/.bun/install/cache, ~/.local/share/pnpm/store, ~/.pnpm-store, ~/.yarn/cache, ~/.cache/yarn
Python	~/.cache/pip, ~/.local/pipx, ~/.local/lib/python*/site-packages, ~/Library/Caches/pip (macOS)
Conda	~/miniconda3/pkgs, ~/anaconda3/pkgs, ~/.conda/pkgs
Go	$GOMODCACHE, else $GOPATH/pkg/mod, else ~/go/pkg/mod
Rust	$CARGO_HOME/registry and $CARGO_HOME/git (default ~/.cargo)
Ruby	$GEM_HOME or ~/.gem
PHP	~/.composer, ~/.config/composer
Java	~/.m2/repository, ~/.gradle/caches
.NET	$NUGET_PACKAGES or ~/.nuget/packages
Dart	$PUB_CACHE or ~/.pub-cache
Elixir	~/.hex, ~/.mix

Whole machine (--include-system)

Scans a machine instead of a checkout: the system-wide install locations below, the home-cache table for every account under the system root (/home/*, /Users/* on macOS images, and /root), and the system binary directories. Run it as root to read other accounts’ files.

Ecosystem	System directories
JavaScript	/usr/lib/node_modules, /usr/local/lib/node_modules, /usr/share/nodejs, /opt/homebrew/lib/node_modules
Python	/usr/lib/python3*/site-packages, /usr/lib/python3*/dist-packages, /usr/lib/python3/dist-packages, /usr/lib64/python3*/site-packages, /usr/local/lib/python3*/site-packages, /usr/local/lib/python3*/dist-packages, /opt/homebrew/lib/python3*/site-packages, /Library/Frameworks/Python.framework/Versions/*/lib/python3*/site-packages
Conda	/opt/conda/pkgs, /opt/miniconda3/pkgs, /opt/anaconda3/pkgs
Go	/usr/local/go/pkg/mod
Rust	/usr/local/cargo/registry, /usr/local/cargo/git
Ruby	/var/lib/gems/*, /usr/share/gems, /usr/lib/ruby/gems/*, /usr/lib64/ruby/gems/*, /usr/local/lib/ruby/gems/*, /usr/local/bundle
PHP	/usr/share/php, /usr/local/share/composer/vendor
Java	/usr/share/java, /usr/share/maven-repo
.NET	/usr/share/dotnet/sdk/NuGetFallbackFolder
Binaries	/usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin, /bin, /sbin, /usr/libexec, /usr/local/lib, /opt

The binary directories are scanned by the IOC scan only, so a dropped executable’s embedded C2 host or mining-pool address is found.

Environment overrides ($GOMODCACHE, $CARGO_HOME and so on) apply to your own account only; another account’s environment cannot be read.

Another filesystem

--system-root points --include-system at a mounted volume, an unpacked image or a running process’s root, instead of /:

sudo vulnetix malscan --include-system --system-root /mnt/backup-volume
sudo vulnetix malscan --include-system --system-root /proc/$(pidof myapp)/root

Limits

Limit	Default	Flag
Directory depth inside each target	unlimited	--scan-depth
Largest file the IOC scan reads	10 MiB (10485760 bytes)	--max-file-size
Manifest or install script read by detect	512 KiB	none
Packages analysed by detect, per run	4,000	none