MAL-HOOK Install, Build, and Git-Hook Execution Surfaces
Code that runs automatically on clone, install, or build executes before a single line of the application's own code is invoked. This rule surfaces those execution surfaces outside the npm package.json lifecycle (which other detectors already cover) so a developer or an agent can read what a just-cloned repository will do before running it.
What Vulkro detects
Four rules, each requiring an execution surface that also carries a risky token (a remote fetch, a pipe into an interpreter, an eval, a base64 decode).
MAL-HOOK-001 (High or Medium) fires on a git hook under .git/hooks/ that is not one of git's .sample templates, or a husky hook under .husky/, whose body carries a risky token. A remote fetch piped into a shell grades High; any other risky token grades Medium.
MAL-HOOK-002 (High) fires on a Makefile recipe that pipes a remote fetch straight into a shell.
MAL-HOOK-003 (High or Medium) fires on a Python setup.py or pyproject.toml build step that shells out while carrying a risky token, or that fetches a URL and then evaluates it. setup.py runs at pip install time, so this is install-time code execution.
MAL-HOOK-004 (Medium) fires on a Cargo build.rs that shells out with a risky token or fetches over the network at build time. A plain Command::new("cmake") build script is left quiet.
Comments are blanked before matching, so a docblock that names curl ... | bash while explaining why not to do it is not scored as code. The rule never certifies code safe: it surfaces execution surfaces that carry a risky token.
Remediation. Read the hook or build step and confirm the fetch target and the executed content are ones you control. Replace pipe-to-shell installs with a pinned, checksum-verified artifact, and move anything that does not need to run at install time into an explicit command the developer chooses to invoke.
See also
- Confidence model - what
High,Medium, andLowmean for findings in this category. - Safety - what Vulkro does and does not access on your machine.
References
This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.