Static Code Analysis
Find high-risk behaviors in a package coordinate
A package coordinate in, behavior findings out.
overview
What malcontent-scan does
malcontent looks through a package coordinate for high-risk behaviors. Network calls, filesystem writes, and similar rules become rows in the findings file.
A Managed-fleet smoke on one coordinate printed scanned 1, 0 findings. An empty findings file means malcontent kept no behavior for that coordinate.
Use GuardDog when you want indicator hits such as install scripts. Use OSV Malicious when you want a published MAL id.
use cases
Where malcontent-scan fits
Look for a network behavior
Feed a coordinate and read whether malcontent kept a behavior rule.
Accept a quiet package
Zero findings means malcontent kept no high-risk behavior for that name and version.
Keep indicators on another node
Run GuardDog when the question is an install-script or typosquat signal, not a behavior rule.
reference
malcontent-scan inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| input | FOLDER | --input | Folder of package coordinate JSONL files. |
Showing key inputs. malcontent-scan exposes 1 inputs in total.
example
Run malcontent-scan
malcontent-scan --input ./packagesmalcontent-scan: scanned 1, 0 findings across 0 packagesguidance
Choosing malcontent-scan
Use malcontent for behavior rules such as network or filesystem use. Use GuardDog for malware-indicator hits, and OSV Malicious for a published MAL id.
guarddog
Checks package coordinates for malware indicators.
osv-malicious
Returns published malware advisory ids.
osv-scanner
Matches lockfiles to vulnerability advisories.
faq
malcontent-scan questions
related
More Static Code Analysis tools
bandit
Python source in, JSON security findings out.
gitleaks
Detect hardcoded secrets in git repos and plain directories.
gosec
Go AST security scanner for credentials, crypto, and injection.
guarddog
A package coordinate in, indicator hits out.
osv-malicious
A package coordinate in, malware advisory rows out.
osv-scanner
A lockfile in, advisory rows out.
Run malcontent-scan yourself
One package coordinate produced no malcontent behavior finding, so the findings file was empty.
Facts on this page come from the live Trickest tool library.