# `scan_dependency_malware`

Use for explicitly requested, bounded static review of installed dependency
code. Prefer the defaults first; increase bounds only when the returned
completeness evidence justifies it.

Inputs: optional `max_packages` (default 2000), `max_files` (50000),
`max_bytes` (67108864), `max_file_bytes` (1048576), `max_findings` (500), and
`output_format`.

```json
{"max_packages":2000,"max_files":50000,"max_findings":500,"output_format":"json"}
```

Findings are heuristic review signals. Do not claim execution, credential
exposure, package compromise, or safety from this static scan.