> For the complete documentation index, see [llms.txt](https://docs.xygeni.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.xygeni.io/xygeni-products/code-security-cs/malware-scanner.md).

# Malware Scanner

## Table of Contents

1. [Purpose](#purpose)
2. [Quick Start](#quick_start)
3. [Usage](#usage)
4. [Malware Detectors](#detectors)

### Purpose <a href="#purpose" id="purpose"></a>

A compromised software supply chain can result in alterations to the software, potentially serving as a vector for malware distribution. Allowing malicious actors to introduce harmful code, unintended behaviors and backdoors.

**Malicious Code Evidence** consists of indicators of malicious software (malware) identified through static analysis of the target software. Analyzing software for potential supply chain vulnerabilities complements software security reviews with automation. Adversaries often employ obfuscation techniques to conceal their alterations from human review, but these methods can also provide evidence of their behaviour. See ([Common types of Malware found in Open Source Packages](/xygeni-products/open-source-security-oss/malware-early-warning-mew/common-types-of-malware-found-in-open-source-packages.md))

Based on the collected evidence, a `maliciousness score` is calculated for the software being analyzed. If sufficient evidence is gathered, the software may be classified as potentially malicious.

The **Malware Scanner** is a tool that analyzes software project files and reports the evidence detected by the active malware policies assigned to the project. Detected evidence can be uploaded to Xygeni platform for consolidation and for enabling response actions.

{% hint style="info" %}
The `maliciousness score` of the project depends on the total **quantity** and **severity** of the **evidence identified**.
{% endhint %}

### Quick Start <a href="#quick_start" id="quick_start"></a>

Use the following command to run and upload the results of the **Malware Scan** to the **Xygeni Platform.** This command will scan the current directory for the target project.

```bash
xygeni malware -n MyProject --upload
```

{% hint style="info" %}
Malware scanner can be run in two different ways:

* Running its own specific command ( `xygeni malware [options]` )
* Running the general command ( `xygeni scan --run="malware" [options]` )
  {% endhint %}

Export malware evidence with critical severity to CSV for review or to import findings into other tools:

```bash
xygeni malware -n MyProject --detectors critical \
       --format csv --output MyProject.malware.csv
```

### Usage <a href="#usage" id="usage"></a>

Use the `xygeni malware [options]` command to execute the Malware Scanner.

To view all available options, use the `--help` flag:

```bash
xygeni malware --help
```

The most important properties are:

* **Name** of the Xygeni Project `-n` or `--name`.
* **Input source** to analyze. Either specify a **directory** with: `-d` or `--dir` or specify a **repository** using: `--repo`. The scan will analyze the current working directory when no target is specified.
* **Upload** results to the service `--upload`. By default, results are not uploaded.
* **Output file** (`-o` or `--output`) and **format** (`-f` or `--format`). If no output file is specified (or stdout / - are used), the standard output is used. Use `--format=none` for no output.
* Specify what detectors to run with the `--detectors` / `--skip-detectors` options. A common use-case is to consider only issues with high or critical severity with `--detectors=high`.
* The *resource kinds* to be scanned could also be tailored with the `--kinds` / `--skip-kinds` options.

```bash
Configuration options:
      --custom-detectors-dir=<customDetectorsDir>
                             Directory with custom detectors.
      --detectors=<detectors>
                             Comma-separated list of IDs for detectors to run, PRIORITY or 'all'
      --skip-detectors=<skipDetectors>
                             Comma-separated list of IDs for detectors to ignore, or PRIORITY
      --kinds=<kinds>        Resource kinds to scan (execution, file, network, _package, registry,
                               sensitive_data, system, all).
      --skip-kinds=<skipKinds>
                             Resource kinds to ignore (execution, file, network, _package, registry,
                               sensitive_data, system, all).
```

### Malware Detectors <a href="#detectors" id="detectors"></a>

Please refer to the [Malware detectors](/xygeni-products/code-security-cs/malware-scanner/malware-detectors.md) documentation for information regarding this topic.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.xygeni.io/xygeni-products/code-security-cs/malware-scanner.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.