Malice-Scan: A Configurable Multi-Language Static Security Scanner for Pattern-Based Code Analysis

Abstract

Software projects often contain insecure coding practices, suspicious constructs, exposed secrets, and other patterns that require early identification during development and code review. This paper presents Malice-Scan, a configurable static analysis security scanner designed to inspect source code without executing it. The implemented system supports JavaScript, Python, PHP, Java, Ruby, and Shell scripting. Its architecture separates command-line orchestration, the detection engine, configuration management, utility functions, and multi-format reporting. The scanner applies forty configurable regular-expression-based detection patterns covering code injection, backdoors and network operations, runtime-error patterns, cryptographic weaknesses, and other security-relevant issues. It further incorporates heuristic checks for minified JavaScript and large Base64-like content, along with confidence estimation based on severity, dangerous keywords, entropy, and contextual indicators. Practical safeguards include file-size limits, regular-expression timeouts, Base64 decoding limits, scan-depth limits, path-traversal controls, and per-rule finding limits. Findings can be filtered by severity and exported in JSON, HTML, or CSV formats. The test structure includes vulnerable and clean samples, with a comprehensive test project containing 77 intentional issues across six supported languages. The resulting system provides a lightweight and extensible approach for security-oriented source-code scanning and can be integrated into local review and CI/CD workflows.

Introduction

The text describes Malice-Scan, a lightweight and configurable static security scanner designed to detect suspicious and potentially insecure code without executing it. It is intended to support developers, security teams, DevOps engineers, and code reviewers during early security analysis.

Key Points

• Purpose: Detect security-related coding patterns and suspicious constructs before software execution, helping identify issues during development and code review.
• Supported languages: JavaScript, Python, PHP, Java, Ruby, and Shell scripting.
• Detection approach: Uses 40 configurable pattern-based rules (R001–R040) along with lightweight heuristics rather than advanced semantic analysis.
• Security categories: Rules cover areas such as:
  • Code injection and dangerous functions
  • Backdoors and network operations
  • Runtime-error patterns
  • Cryptography and security weaknesses
  • Hardcoded secrets
  • SQL/command injection
  • Webshell and reverse-shell indicators
  • Unsafe deserialization
  • Path traversal
  • Weak cryptography
  • SSRF and CORS issues
  • Prototype pollution
  • Base64 and obfuscation indicators
• Architecture: The system has separate modules for CLI management, detection, configuration, reporting, utilities, and pattern definitions.
• Scanning workflow: It recursively discovers source files, identifies their language, applies exclusion and size rules, runs relevant detection patterns, performs heuristic checks, calculates confidence, filters results by severity, and generates reports.
• Confidence estimation: Findings receive a score between 0.0 and 1.0, influenced by severity, keywords, entropy, and contextual factors. These scores are intended for prioritization rather than representing statistically proven vulnerability probabilities.
• Reporting: Results can be exported as JSON, HTML, or CSV, making them suitable for automated processing, detailed review, or spreadsheet analysis.
• Operational safeguards: The scanner includes file-size limits, regex execution timeouts, Base64 decoding limits, scan-depth restrictions, path-traversal validation, and limits on findings to reduce risks such as excessive resource consumption and ReDoS.
• Limitations: Malice-Scan is not intended to replace expert review, advanced SAST tools, or semantic analysis. Pattern matching can produce false positives and may miss vulnerabilities that require business or semantic context.

Conclusion

This paper presented Malice-Scan, a configurable multi-language static security scanner based on forty regular-expression detection patterns, file-level heuristics, confidence estimation, configurable scanning controls, and JSON/HTML/CSV reporting. The implemented architecture separates orchestration, detection, configuration, utilities, and reporting, allowing the system to scan supported projects and present findings in forms suitable for security review and automation. The testing assets include intentionally vulnerable samples across all six supported languages, while the available evidence supports functional evaluation rather than claims of quantified detection accuracy. Future work should focus on strengthening the evidence base and extending analysis depth. Supported directions include systematic evaluation against labeled benchmarks, explicit measurement of false positives and false negatives, reproducible performance experiments, expanded and validated rule sets, improved language-aware parsing, data-flow and control-flow analysis, richer handling of encoded or obfuscated content, and tighter CI/CD feedback mechanisms. These enhancements should be evaluated empirically before claims of improved detection effectiveness are made.

References

[1] B. Chess and G. McGraw, “Static Analysis for Security,” IEEE Security & Privacy, vol. 2, no. 6, pp. 76–79, 2004, doi: 10.1109/MSP.2004.111. [2] OWASP Foundation, OWASP Code Review Guide, Version 2.0, methodology and source-code scanning guidance. Available: OWASP Project documentation. [3] OWASP Foundation, OWASP Web Security Testing Guide, guidance on static source-code review and limitations of automated source-code analysis. [4] G. Bennett, T. Hall, E. Winter, and S. Counsell, “Semgrep*: Improving the Limited Performance of Static Application Security Testing (SAST) Tools,” in Proceedings of the 28th International Conference on Evaluation and Assessment in Software Engineering (EASE ’24), 2024, pp. 614–623, doi: 10.1145/3661167.3661262. [5] “Detecting security vulnerabilities with static analysis – A case study,” Acta Polytechnica Hungarica / related published case-study record, 2021, doi: 10.1556/606.2021.00454.

Copyright

Copyright © 2026 Pilli Chandana Das, D Venkateswarlu. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.