Pass 14: Malware Scanning (MALWARE)

Property	Value
Pass number	14
Key (--passes)	malware (alias mal in --passes and lens profiles)
Signal prefix	MAL
Type	Deterministic, using external command-line scanners
Default	Optional (opt-in): not in the default --passes list
Assessment types	application; service when binary files are supplied and the pass is requested
Tier	All tiers (no licence gate)
Source	packages/@swao/module-app-assessment/src/passes/pass-14-malware.ts

What it is for

Pass 14 answers the question: "Does the code or the supplied software contain known malware, hard-coded secrets, vulnerable dependencies or problematic licences?"

It runs established open-source scanners over the application source tree (or, in a service assessment, over the supplied binaries) and turns their findings into SWAO signals. Clean results are recorded as positive signals, so the report can show that a check ran and found nothing.

What you need to provide

Input	Notes
The scanners on your PATH	Gitleaks, OSV-Scanner, ClamAV and YARA are enabled by default; ORT is off by default. Missing tools are skipped.
A lockfile in the root of the source path (for OSV-Scanner)	package-lock.json, yarn.lock, pnpm-lock.yaml or pnpm-lock.yml
YARA rules (for YARA)	.yar or .yara files in apps/<app>/wsp/inputs/yara-rules/ (not recursive), or another folder set in .swao.yml
ORT rules script (optional, for MAL-12)	apps/<app>/wsp/inputs/ort-rules.kts, or another file set in .swao.yml

Run swao health-check to see which of gitleaks, osv-scanner, clamav (checked via clamscan) and yara are installed. ORT is not part of that check. Installation commands for each tool are on the Malware scanning page.

How it works

The pass runs each enabled tool in turn. Each tool is independent: a missing or failing tool does not stop the others.

1. Gitleaks runs gitleaks detect --source <source> --no-git with a JSON report (60 s timeout). An optional custom configuration file can be supplied.
2. OSV-Scanner runs osv-scanner --lockfile <file> --format json against the first supported lockfile found in the source root (60 s timeout).
3. ClamAV tries the daemon client clamdscan first; if it is missing or the daemon is not running, it falls back to clamscan -r (120 s timeout).
4. YARA runs yara -r <rule file> <source> once per rule file (60 s timeout per file).
5. ORT (only if enabled) runs ort analyze on the source (180 s timeout). If a rules script exists, it then runs ort evaluate (60 s timeout).
6. Temporary report files are written to the system temp folder and deleted afterwards.

How it is measured

Signal	Tool	Finding	Severity on finding	On a clean run
MAL-00	-	All enabled tools are missing, so nothing could be scanned	high (outcome negative)	-
MAL-01	ClamAV	Antivirus signature matches (file and signature name)	critical	positive
MAL-02	YARA	Rule matches (rule name and file)	high	positive
MAL-03	Gitleaks	Secrets detected (rule, file and line)	high	positive
MAL-09	OSV-Scanner	Known vulnerabilities per package and version	high	positive
MAL-10	ORT analyze	Dependencies with a copyleft or reciprocal licence. Declared licences listed in controls/licence-risk-catalogue.yaml are classified by licence class (network, strong and weak copyleft count; this includes SSPL-1.0, EPL, CDDL, OSL-3.0 and CeCILL, and MIT OR GPL-2.0-only resolves to MIT); unlisted licences fall back to SPDX IDs starting with GPL, AGPL, LGPL, EUPL, OSL, CeCILL, MPL, CDDL or EPL	high; the derivation names network copyleft when a catalogue tier critical licence (AGPL, OSL-3.0) is present	positive
MAL-11	ORT analyze	Dependencies without a declared licence	high (confidence medium)	positive
MAL-12	ORT evaluate	Policy rule violations from your rules script	high	positive
MAL-13	ORT analyze	Dependencies whose licence restricts use rather than imposing copyleft: source-available licences (BUSL-1.1, Elastic-2.0) and Creative Commons non-commercial or no-derivatives terms	medium when a source-available licence is present, low otherwise	positive (only when the catalogue loaded)

IDs MAL-04 to MAL-08 are not used. All findings are aggregated: one signal per tool, with each finding listed as evidence.

Licence classification (#3160). MAL-10 and MAL-13 read controls/licence-risk-catalogue.yaml (38 SPDX identifiers, each with a risk tier: critical, high, medium, low or clear, and a licence class that decides between MAL-10 and MAL-13). An SPDX expression is evaluated term by term: OR takes the least risky alternative, AND the riskiest term, WITH <exception> is ignored, and deprecated forms (GPL-2.0, GPL-2.0+) map to -only and -or-later. If the catalogue is missing or invalid, MAL-10 uses the SPDX prefix list alone, MAL-13 is not emitted, and assessment.licence_risk_catalogue records the reason.

Exit codes are interpreted per tool: for Gitleaks, OSV-Scanner and ClamAV, exit 0 means clean and exit 1 means findings; higher codes are recorded as tool errors in assessment.errors. If OSV-Scanner reports findings but its JSON cannot be parsed, SWAO still emits a high MAL-09 with the raw output as evidence (confidence medium).

The pass status is complete when at least one tool ran and not_applicable when none did. assessment.malware_scan_status is complete, skipped_tools_missing or skipped_all_disabled.

With --malware-fail-on-detection, swao assess exits with code 5 when a MAL-01 or MAL-03 finding (not a positive all-clear) is present.

Third-party modules, tools and external services

Tool	Purpose	Licence	Bundled or optional	When missing
Gitleaks	Secret detection	MIT	Optional, install yourself	Skipped with an install hint
OSV-Scanner	Vulnerabilities in lockfile dependencies (queries the OSV.dev database)	Apache-2.0	Optional	Skipped; also skipped when no lockfile is found
ClamAV (clamdscan / clamscan)	Antivirus signatures	GPL-2.0	Optional	Skipped
YARA	Custom pattern rules	BSD-3-Clause	Optional	Skipped; also skipped when no rule files exist
OSS Review Toolkit (ORT)	Licence analysis and policy evaluation (requires a Java runtime)	Apache-2.0	Optional, disabled by default	Skipped

The tool licences listed are those published by the upstream projects; SWAO only calls the tools and does not ship them. OSV-Scanner and ClamAV signature updates need network access according to their own configuration; SWAO itself makes no network calls in this pass.

Outputs

File	Content
apps/<app>/wsp/runs/<ts>/passes/14-malware.yaml	Pass header, MAL-NN signals and assessment with tools_attempted, tools_skipped, malware_scan_status, missing_tools, errors and, when ORT ran, licence_risk_catalogue (loaded or skipped: <reason>)

Configuration and limitations

Enable the pass on the command line:

swao assess --app app-crm-01 --passes inv,state,data,ctx,sbom,tf,egr,crypto,synth,comp,blocks,scope,malware
swao assess --app app-crm-01 --passes malware --malware-fail-on-detection

Tool settings live in the app .swao.yml. Paths are relative to the app folder:

passes:
  malware:
    tools:
      gitleaks:
        enabled: true
        config_file: wsp/inputs/gitleaks.toml   # optional
      osv_scanner:
        enabled: true
      clamav:
        enabled: true
      yara:
        enabled: true
        rules_dir: wsp/inputs/yara-rules        # default
      ort:
        enabled: false                          # default; JVM tool, can take minutes
        rules_file: wsp/inputs/ort-rules.kts    # default

Known limitations:

• OSV-Scanner is only run for npm, Yarn and pnpm lockfiles in the root of the source path. Other ecosystems (for example Maven or pip) are not scanned by this pass; see Pass 05 SBOM for dependency vulnerabilities.
• MAL-00 is raised only when no tool at all could run. If some tools are missing, the others still run and the missing ones are listed in tools_skipped without a separate warning signal.
• YARA reads rule files only from the top level of the rules folder.
• Timeouts are fixed; very large source trees can exceed them, which is recorded as a tool error.
• Gitleaks scans the working tree (--no-git), not the Git history.

See also Malware scanning for installation and examples.