Install malcontent with Homebrew

Project links

• Homepage

Commands and aliases

• mal

Project history

The GitHub repository was created in February 2024 and is maintained under the Chainguard organization. The README presents it as a "subtle malware discovery tool" for supply-chain attack detection, using a large embedded YARA rule set and contextual comparisons rather than only standalone signature hits.

malcontent's project shape reflects the post-SolarWinds and post-3CX supply-chain security era: it is built for CI/CD use, supports container images and archives, and treats behavior changes between releases as a key signal. The README uses the 3CX compromise as an example of differential analysis surfacing newly risky behavior.

Adoption history

Public adoption is still young but visible through the GitHub repository's releases, stars, forks, and companion GitHub Action. The README emphasizes Linux programs while noting useful coverage for other Unix platforms such as macOS and, to a lesser extent, Windows.

Chainguard also references malcontent in its supply-chain security writing as a binary analysis tool that can surface newly introduced capabilities without requiring full reverse engineering. That positions it as a practical package-review tool for maintainers evaluating suspicious upstream or dependency changes.

How it is used

`mal analyze` enumerates capabilities in a target, `mal diff` compares two paths, archives, reports, or images, and `mal scan` reports findings above a risk threshold. It supports output formats including JSON, YAML, Markdown, text, terminal, and TUI-style output, and includes an opt-in `--oci-auth` mode for private image pulls.

Why package nerds care

malcontent matters to package maintainers because it targets the hard question a package diff raises: did this new release gain suspicious behavior? It is especially relevant to registry ecosystems, binary packages, vendored archives, container images, and CI checks where maintainers need quick triage before publishing or upgrading.

Timeline

• 2024-02-07: The malcontent GitHub repository is created.
• 2024: The README documents analyze, diff, and scan modes for supply-chain compromise discovery.
• 2025: malcontent-action publishes an initial GitHub Action for PR differential scanning.
• 2026: The repository lists over one hundred releases and continued active maintenance.

Related projects

• Related tools and ecosystems include YARA/YARA-X, VirusTotal rule workflows, Chainguard Images, malcontent-action, container image scanners, and CI/CD supply-chain security checks.

Sources

• https://api.github.com/repos/chainguard-dev/malcontent
• https://github.com/chainguard-dev/malcontent
• https://github.com/chainguard-dev/malcontent-action
• https://raw.githubusercontent.com/chainguard-dev/malcontent/main/README.md
• https://www.chainguard.dev/unchained/cyber-resiliency-in-practice-lessons-from-recent-supply-chain-attacks