Testing with Malware Samples

The default checkout and ordinary test suites do not contain or require real malware samples. They use harmless fixtures for scanner behavior and rule-boundary coverage.

Maintainers can run the separate laboratory corpus suite by provisioning the verified corpus, setting AMWSCAN_CORPUS_DIR, and running:

composer test:corpus

The requested run fails if corpus files are missing or do not match tests/Corpus/manifest.json. Samples are read only as data and must never be executed, included, evaluated, or served.

caution

The corpus is sensitive laboratory material. It is not downloaded automatically, included in release packages, or made available to untrusted pull-request jobs.