[afeezorobsco-cyber]

The malware scan's disguised-code rule fires when a file whose extension isn't a known code type contains JavaScript. That catches payloads hidden as fonts or images, like the one in escrow #163. But .vue single-file components legitimately contain <script> blocks, so docforum-core #207 (docs/site/api/ApiReference.vue) was flagged HIGH, and because Malware scan is a required check, it was blocked.

Change: vue, svelte, astro, less, sass, go, mod and sum are added to the scanner's code/text extension list. These files are still scanned by every line rule (pipe-to-shell, exfiltration endpoints, decode-and-run and so on); they're just no longer treated as "this shouldn't contain code". Real media files (fonts, images, archives, .wasm) are unchanged.

Tested with the scanner harness against live PRs:

• core ci: manual backfill mode for the PR malware scan #207: before high=1 [disguised-code], after high=0.
• Real HIGH findings still caught: core feat(sdk-rust): rust interface crate for cross-contract escrow calls #185 (untrusted action), core feat(contract): bound condition_ref length and validate it at creation #191 (base64 file), escrow feat(sdk): support smart-wallet (passkey) payers via contract-account auth #175 and feat(security): audit-readiness package for the Phase E5 contract features #211 (base64 files).
• escrow feat(e6): React hooks, Wallets Kit signer, Go SDK and OTel hooks #215 (Go SDK): only the expected workflow-change warnings.

pull_request_target runs the scanner from main, so this takes effect once merged. I'll then re-scan core #207 with the backfill.

🤖 Generated with Claude Code