fix(malware-scan): cut false positives from vendor bundles and require() calls

[Satendra-SR]

Summary

Cuts false HIGH findings from the malware scanner without weakening detection of the real payload. On kdn-website the scanner reported 12 HIGH, all from JSDoc comments in Elementor's bundled AI scripts, such as ai-admin.js:16199:

 * @param {Object}<155 spaces>options

That's formatting inside a comment, not hidden code.

Changes (malware-scan/scan_malicious.py)

• WHITESPACE_PADDING: now low (hidden by default) outside config files when nothing code-like follows the padding and either:

  • the hidden text is short (under 200 characters), or
  • the line is a comment (*, //, /*, #).

  It stays high when code-like tokens are hidden (require(, global[/global., eval(, Function(, fromCharCode, child_process, _$_xxxx, import(, URLs, atob(, Buffer.from), or 200+ characters of non-comment text. It's always high in config files (*.config.*), where the payload is injected.

• GLOBAL_REQUIRE: no longer matches storing a require() call result (global.performance = require("perf_hooks"), found in Moodle's ogv.js WASM decoders). It still matches assigning the require function itself (global['r'] = require, global[_$_a291[0x11]] = require), as the payload does.

• malware-scan/README.md: rules table updated.

Verification (text-only; no sample executed)

Sample set	Before	After
10 real infected files (coloredcow esbuild.config.js; sankalptaru-website build-js.js + rank-math webpack.config.js; sankalptaru-huge react-native.config.js; sankalptaru-mobile metro.config.js; Internal-intelligence-platform server.js + postcss.config.mjs; pai postcss.config.mjs; volunteer-module index.js; sparklegacy postcss.config.js)	4–6 high each	unchanged, same rules
Elementor AI bundles (kdn-website)	12 high	0 high (whitespace → low)
Figma plugin-api-standalone.d.ts	5 high	0 high
Moodle ogv-decoder-*-wasm.js	3 high	not flagged
kdn-website, whole repo	12 high	0 high

Synthetic edge cases:

Case	Result
Comment line hiding */require(...)	high
Code line hiding 250 characters	high
Padded comment in tailwind.config.js	high
Short payload shape (global.o=...;var _$_ab12)	high
Long JSDoc text after padding	low

After merge

• Bump the pinned SHA in consumer workflows (sankalptaru-website #813, coloredcow #1513) and in the team guide's YAML snippet.
• Anyone with the cc-malware-scan skill installed should re-run the install block to get the new scanner.

🤖 Generated with Claude Code

[Satendra-SR]

Made some changes to remove some white listing false cases - came from KDN website