unknown-cyber-inc/Package Binary Scanner
Scans software packages for security threats including binaries, scripts, and malware. Auto-detects npm, pip, maven, cargo, go, ruby, nuget, dpkg, apk, and rpm ecosystems.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| scan-path | Path to the directory to scan | no | . |
| ecosystems | Comma-separated list of ecosystems to scan (npm, pip, maven, cargo, go, ruby, generic). Default: auto-detect from installed packages. | no | "" |
| deep-scan | Enable deep scan using magic bytes detection (slower but more thorough) | no | false |
| upload | Upload found binaries to UnknownCyber API | no | false |
| skip-existing | Skip uploading files that already exist in UnknownCyber (default: true) | no | true |
| get-reputations | Fetch reputation data for existing files (default: true) | no | true |
| include-package-json | Include package.json files for SBOM creation | no | false |
| include-all-files | Include ALL files in package directories (not just executables) | no | false |
| api-url | UnknownCyber API URL | no | https://api.unknowncyber.com |
| api-key | UnknownCyber API key for authentication | no | "" |
| repo | Repository name to tag uploads with (defaults to current GitHub repository) | no | ${{ github.repository }} |
| yara-scan | Enable YARA scanning | no | false |
| yara-rules | Path to additional YARA rules file or directory | no | "" |
| yara-include | File patterns to scan with YARA (e.g., "*.js,*.html"). If empty, scans binaries from results. | no | "" |
| generate-summary | Generate a summary report in GitHub Actions UI with links to UC reports | no | false |
| fail-on-threats | Fail the action if HIGH/MEDIUM threats or high-severity YARA matches are found | no | false |
| license-check | Enable license compliance checking (npm only) | no | false |
| license-policy | License policy file path or preset (permissive, strict, copyleft-ok) | no | permissive |
| fail-on-license | Fail the action if denied licenses are found | no | false |
| artifact-name | Name for the uploaded artifact (use unique names when running multiple scans in same workflow) | no | binary-scan-results |
Outputs
| name | description |
|---|---|
| total-packages | Number of packages containing binaries |
| total-binaries | Total number of binary files found |
| results-file | Path to the JSON results file |
| upload-successful | Number of successfully uploaded files |
| upload-failed | Number of failed uploads |
| upload-skipped | Number of files skipped (already exist in UC) |
| threats-found | Number of files with HIGH or MEDIUM threat level |
| ecosystems-scanned | List of ecosystems that were scanned |
| yara-matches | Number of files with YARA rule matches |
| yara-high-severity | Number of files with high/critical severity YARA matches |
| license-allowed | Number of packages with allowed licenses |
| license-warning | Number of packages with licenses needing review |
| license-denied | Number of packages with denied licenses |