Skip to main content

MAL-GATE Environment-Gated Detonation

A time-bomb or logic-bomb hides a dangerous action behind a condition that only becomes true off the developer's machine or after a chosen moment: a date, a production hostname, a country or timezone, or the absence of CI. Until the gate opens the code looks inert, so reading or briefly running a just-cloned repository shows nothing.

What Vulkro detects​

MAL-GATE-001 fires when a gating token and a dangerous-sink token fall within a small window of source lines in the same file, in a region that also contains a conditional keyword.

Gating sources fall in two strength bands. Strong gates (Date.now(), new Date, .getTime(), os.hostname(), socket.gethostname(), uname, a timezone / locale / Intl check, a country, geo, or IP check) have no benign skip-in-CI explanation and grade High. Weak gates (process.env.CI, a named environment-variable check, process.argv / sys.argv) grade Medium and are review-only, because legitimate code genuinely branches on CI and argv.

Dangerous sinks reuse the Inspect vocabulary: child_process exec / spawn, eval / new Function, fetch / http(s).request / requests.*, os.system / subprocess.*, and destructive filesystem verbs such as fs.rmSync, rm -rf, shutil.rmtree.

What this does not claim: there is no control-flow graph here. It does not prove the branch actually guards the sink, only that a gate, a conditional, and a dangerous capability are co-located the way a logic-bomb is written. A lone gate (a normal feature flag) or a lone sink must not fire.

Remediation. Read the conditional and ask what happens on the branch you are not on. If the gated action is destructive, network-bound, or executes code, do not run the repository on a machine that satisfies the gate.

See also​

  • Confidence model - what High, Medium, and Low mean for findings in this category.
  • Safety - what Vulkro does and does not access on your machine.

References​

This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.

Last updated on