Four detectors over every resolved target
Scan targets are resolved per ecosystem: the project local install directories by default, and the shared home caches when you ask for them.
Known bad domains, addresses and URLs matched in text files and in strings pulled out of binaries, reported with the file, the line and the surrounding context.
Manifest and install script patterns, plus shell obfuscation analysis: download and execute, reverse shells, onion service callbacks, and payloads assembled at runtime.
Exfiltration endpoints, wallet addresses and install commands attached to the finding as evidence a responder can pivot on.
Integrity checksums checked against a known bad artefact set, which catches a republished version that kept its name and number.
A fifth detector covers the multi step patterns a single line rule cannot see: global install hook persistence, startup auto import persistence, lifecycle scripts that decode and then send, credential exfiltration from a setup script, build script persistence into the toolchain configuration, and reflective loading followed by egress.
No fuzzy trust score, three factual classes
Calling a maintainer's package malicious is a serious accusation. Evidence marks a package malicious on its own: download and execute, a reverse or bind shell, data exfiltration, an onion service as a source, a known bad hash or indicator. A trigger never mints a verdict alone, such as a high entropy payload or an ownership change, and contributes only in combination. Context is recorded for the reviewer and never mints: a missing checksum, a plain HTTP source, a name shaped like a typosquat.
The same primitive is benign or malicious depending on what it reaches
A postinstall script building a native addon from the package's own releases is normal. One that decodes a blob and then opens a network connection is not. Reading one named environment variable is normal. Dumping the whole environment and reading cloud or SSH credentials is not. Decoding base64 into data is normal. Decoding into eval is the taint edge that settles it. A pinned, checksum verified download from a vendor CDN is normal. An unpinned blob from a paste site piped into an interpreter is not.
False positives are controlled by allowlisting reserved addresses and well known registry, CDN, standards and documentation domains, by treating dual use commands as evidence only on a surface that runs without user action, by recognising minified bundles before considering obfuscation, and by requiring a compounding signal before a typosquat name counts.
Take the indicators with you
The indicator feeds behind the scan are published as STIX, per ecosystem, so your own detection stack can use them without going through Vulnetix at all. Findings are written as SARIF with the offending code sample attached, so a responder sees the line, not just the package.
Malware scanning runs inside a full code scan by default, and can be turned on for a dependency scan with a gate flag. It owns the malware verdict raised against binaries found by container scanning. To stop a malicious package reaching the build at all, see the Package Firewall.