[afeezorobsco-cyber]

What changed

Adds an automatic PR malware scan: .github/workflows/pr-malware-scan.yml and .github/scripts/pr-malware-scan.js. It runs on every PR open and every push.

It checks for the techniques used against these repos (escrow #163's VS Code autorun payload, escrow #176's typosquatted action, the base64-replaced files) plus the common malware patterns:

HIGH: fails the check	WARN: noted for the reviewer
.vscode/tasks.json with runOn: folderOpen; devcontainer initializeCommand	Other editor/devcontainer config changes
preinstall / install / postinstall scripts; prepare that does more than build	prepare that just runs the package build
Typosquatted npm packages; dependencies from URLs/git; lockfile entries not from registry.npmjs.org	Local file: workspace packages, git crates
GitHub Actions from publishers outside the allowlist (flags lookalikes like dtolstech → dtolnay); pull_request_target	Any workflow change; workflow secret use
JavaScript hidden in font/image/unknown-extension files; node run on a non-JS file	build.rs changes (HIGH if it spawns processes or uses the network)
Files committed as base64; code hidden in whitespace or pushed off-screen	eval / new Function; credential/wallet file access
curl … | sh, reverse shells, Discord/Telegram/pastebin exfiltration, env dumps, decode-and-eval, char-code/hex obfuscation, miners	Pipe-to-shell inside docs (READMEs show install one-liners)

On findings: it posts a single comment on the PR, edited in place on every push. With HIGH findings, the Malware scan check fails, the PR is labelled security-review, and the author is @mentioned. When the findings are fixed, the comment switches to ✅ and the label is removed.

Security

pull_request_target is used deliberately. It's the only trigger that runs on fork PRs without a maintainer approving the run first, so the scan has finished before anyone decides whether to approve CI. It's safe here because the job never checks out, installs or executes PR code. The PR is read as data through the API, and the scanner is a sparse checkout of main. Token permissions are limited to contents: read plus write on issues and PRs (for the comment and label), with persist-credentials: false. actions/github-script is pinned to the v9.0.0 commit SHA.

Testing

All tests ran locally with every write call stubbed out:

• Real attacks: escrow Feat/multiple staff users per facility fixed roles no #163 (from the diff saved before it was removed) gets 3 HIGH findings: autorun task, node running a non-JS file, and JS disguised as a font. escrow feat(consultations): close an appointment's consultation exactly once… #176 is flagged as a typosquat of dtolnay. The six base64-corrupted PRs (feat(auth): email verification on signup, with restricted access for unverified accounts #137, feat(auth): login brute-force protection with per-account and per-IP throttling #138, feat(payments): add platform signer abstraction #175, fix(docs-site): rewrite relative links in local synced files (fixes docs deploy on main) #182, feat(orders): add patient orders read endpoint #201, Feat/5 referral model creation #202) are all flagged.
• Synthetic fixtures: install hook, npm typosquat, URL dependency, decode-and-eval, Discord exfiltration, env dump, char-code payload, curl | bash, reverse shell, pull_request_target, and a typosquatted Action all hit HIGH. A README curl | sh stays WARN.
• False positives: over all 115 open PRs in the three repos, the only HIGH findings were the 7 above, and all are genuine problems. 22 PRs got WARN notes (mostly workflow edits) and 86 were clean.

Recommended follow-up

Once this is on main, make Malware scan a required status check in branch protection, so a flagged PR can't be merged by mistake.

Which ROADMAP.md item does this close/progress?

Adds a completed CI item to ROADMAP.md, per AGENTS.md.

🤖 Generated with Claude Code