Malice-Scan: A Configurable Multi-Language Static Security Scanner for Pattern-Based Code Analysis
TL;DR
Malice-Scan is presented, a configurable static analysis security scanner designed to inspect source code without executing it, which provides a lightweight and extensible approach for security-oriented source-code scanning and can be integrated into local review and CI/CD workflows.
Abstract
Software projects often contain insecure coding practices, suspicious constructs, exposed secrets, and other patterns that require early identification during development and code review. This paper presents Malice-Scan, a configurable static analysis security scanner designed to inspect source code without executing it. The implemented system supports JavaScript, Python, PHP, Java, Ruby, and Shell scripting. Its architecture separates command-line orchestration, the detection engine, configuration management, utility functions, and multi-format reporting. The scanner applies forty configurable regularexpression-based detection patterns covering code injection, backdoors and network operations, runtime-error patterns, cryptographic weaknesses, and other security-relevant issues. It further incorporates heuristic checks for minified JavaScript and large Base64-like content, along with confidence estimation based on severity, dangerous keywords, entropy, and contextual indicators. Practical safeguards include file-size limits, regularexpression timeouts, Base64 decoding limits, scan-depth limits, path-traversal controls, and per-rule finding limits. Findings can be filtered by severity and exported in JSON, HTML, or CSV formats. The test structure includes vulnerable and clean samples, with a comprehensive test project containing 77 intentional issues across six supported languages. The resulting system provides a lightweight and extensible approach for security-oriented source-code scanning and can be integrated into local review and CI/CD workflows.
