aegis-malicious-code
MALCODE — Deliberate Malice Detection
Adaptation note: This module reuses the shared playbook skeleton with two deliberate deviations. Exploitation & Reproduction is a tabletop lab exercise: you construct a throwaway repo containing a fully disclosed, inert canary implant, then practice locating it using this module's own sweep block — dynamic detonation (firecracker/qemu sandboxes, any.run-style services) belongs to a separate dynamic-analysis category and is out of scope here; this module is static-only. Severity Assessment is a trust-impact classification (how much attacker trust a finding implies), not CVSS scoring; no base scores, vectors, or environmental metrics are computed in this module.
Scope & Objectives
This module detects code that someone placed with intent to harm — not accidental defects. The difference drives everything below: accidental vulnerabilities look like bugs and hide in plain sight; deliberate malware looks like nothing and works to hide. Scan for concealment as aggressively as for capability.
Threat origins to model before scanning (know where malice comes from so you know which surfaces it touches):
| Origin | Mechanism | Canonical shape |
|---|---|---|
| Compromised dependency | Maintainer account or package hijacked post-publication; payload rides a semver range into every dependent tree | event-stream incident (npm, 2018): card-wallet-stealing payload added inside an unrelated helper package |
| Typosquat / confusion publish | Look-alike package name published fresh; payload runs at first install | misspelled names, swapped hyphens/underscores, scoped-name impersonation |
| Insider backdoor | Employee or contractor plants auth bypass, time bomb, or exfil in first-party code | hidden route keyed on magic header; date-gated logic |
| Build-system implant | Malicious logic in build scripts that execute at compile/package time, outside reviewed source | build.rs fetching payloads; MSBuild targets injection |
| Vendored prebuilt blob | Binary checked in without matching source or build recipe; behavior unverifiable by review | .node/.so/.wasm files with no origin |
| Hijacked maintainer release | Valid project, attacker-controlled release step injects differencing artifact | release tarball differing from tagged source |