MAL-GATE Environment-Gated Detonation

A time-bomb or logic-bomb hides a dangerous action behind a condition that only becomes true off the developer's machine or after a chosen moment: a date, a production hostname, a country or timezone, or the absence of CI. Until the gate opens the code looks inert, so reading or briefly running it shows nothing.

What Vulkro detects

MAL-GATE-001 fires when a gate and a dangerous sink fall within a few lines of each other in the same file, in a region that also has a conditional keyword.

• Strong gates grade High: Date.now(), new Date, .getTime(), os.hostname(), socket.gethostname(), uname, a timezone / locale / Intl check, a country, geo or IP check.
• Weak gates grade Medium (review only), because real code branches on them: process.env.CI, a named environment-variable check, process.argv / sys.argv.
• Sinks: child_process exec / spawn, eval / new Function, fetch / http(s).request / requests.*, os.system / subprocess.*, and destructive filesystem calls such as fs.rmSync, rm -rf, shutil.rmtree.

There is no control-flow graph: the rule shows a gate, a conditional and a dangerous capability co-located the way a logic-bomb is written, not that the branch guards the sink. A lone gate (a normal feature flag) or a lone sink never fires.

How to fix

• Read the conditional and ask what happens on the branch you are not on.
• If the gated action is destructive, network-bound or executes code, do not run the repository on a machine that satisfies the gate.

References

• OWASP A08:2021

See also: Confidence model.

---

This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.