Malware Detection

Supply chain attackers ship malicious code as packages, container layers, or model weights. Traditional antivirus and signature-based tooling miss most of them. Safeguard uses Eagle — our classification model trained on confirmed-malicious artifacts — to classify every artifact your organization pulls or publishes.

What Eagle Looks For

Eagle scores each artifact across seven indicator classes:

The output per artifact:

• Score 0-100.
• Classification — benign / suspicious / malicious.
• Indicators fired — specific rules that contributed.
• Griffin-authored explanation — plain-English summary of what was unusual.

Coverage

Eagle classifies artifacts in:

Enforcement Points

Eagle's classification feeds into policy at multiple points:

Inline at Install

Via the Safeguard runner or a pre-install hook:

# .safeguard/malware-policy.yaml
malware:
  block: [malicious]
  warn: [suspicious]
  confirm_ttl: 300  # how long a classification is trusted before re-check

If npm install pulls a package classified malicious, the install aborts with an explanation.

At Registry

For your own internal registry, enable inline classification on pushes so internal publishes get scored.

At CI

- uses: safeguard/malware-scan@v2
  with:
    fail-on: malicious

At Admission

The Kubernetes admission controller refuses pods with an image layer containing malicious content.

Historical Scans

When Eagle is updated, it re-scores the entire corpus retroactively. If a package you depend on is reclassified as malicious because of a signal Eagle previously missed, you get a finding within seconds of the re-scoring pass.

The finding includes:

• When the package was installed / deployed.
• What specifically triggered the new classification.
• Recommended remediation (rollback, Gold substitution, or quarantine).

Real Examples

Eagle has publicly surfaced malicious activity in:

• npm packages with hidden post-install scripts exfiltrating ~/.aws/credentials.
• PyPI typosquats of popular ML packages.
• Compromised model repositories on Hugging Face distributing pickle-based payloads.
• OCI images with layers that dropped cryptominers on container start.

See the Incident Analysis blog category for writeups.

False Positives

Eagle is tuned for precision — the classification band-widths are:

• Score < 30: benign, released silently.
• Score 30-70: suspicious, surfaces as a warning with the indicator list.
• Score > 70: malicious, blocked by default policy.

Reported false-positive rate for score > 70 is approximately 1 in 10,000. Reporting a suspected false positive via research@safeguard.sh triggers human review within 24 hours.

Bypass Attempts

When attackers try to evade detection, Eagle flags the evasion itself:

• String splitting / concatenation of known malicious identifiers.
• Delayed-execution payloads that only run weeks after install.
• Package trust "warm-up" — publishing a few benign versions before the malicious one.
• Typosquat rotation (publish under many similar names to defeat allowlists).

AI Model Malware

For AI artifacts specifically:

• Pickle payload detection — model weight files that embed executable Python via pickle.
• Hidden backdoors — statistical tests for neurons or prompt-triggered behaviors that produce attacker-controlled output.
• Config-level injection — transformers config files that reference external code with arbitrary URLs.

CLI

To get the allow, block or warn decision for one package install on your own machine:

safeguard pkgfw check --ecosystem npm --name react --version 19.0.0

To scan a directory of model files for unsafe deserialization or embedded code:

safeguard aisec scan --dir ./models

There is no CLI command for scanning an image for malware or for a package's malware history yet.

Related

• AI Models — Eagle model versions and capabilities.
• Gold: known vulnerabilities in open-source packages, at gold.safeguard.sh.
• Zero-Day Discovery — how malware findings feed Safeguard's research pipeline.
• Guardrails & Enforcement — enforcing malware policy at every point.