MAL-BINARY Committed Native Binaries and Executable Blobs
Source scanners skip files that are not valid UTF-8, so a committed executable is a blind spot. The xz-utils backdoor (CVE-2024-3094) arrived this way: an opaque blob committed as a test fixture.
What Vulkro detects
MAL-BINARY-001 (Medium) reads each file's leading bytes and matches the magic bytes of executable and code-loadable formats:
- ELF (
\x7fELF) - Mach-O (
0xFEEDFACE/0xFEEDFACF, either endian) and fat binaries (0xCAFEBABE) - PE or DOS (
MZ) - WebAssembly (
\x00asm)
It also flags native module extensions a runtime loads directly: .node, .so, .dylib, .dll.
Images, fonts, archives and other benign binary assets are not flagged. Severity is Medium because repositories do vendor binaries legitimately. The finding says an opaque executable exists, nothing about its contents, and never certifies a blob safe.
How to fix
- Find where the binary came from and whether it can be rebuilt from source in this repository.
- Prefer a build step or a checksum-pinned release artifact to a committed executable.
- Treat an unexplained binary in a source package as a reason not to run the build.
References
See also: Confidence model.
This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.