Malus (malus.sh) is a satirical website making the rounds on Hacker News, packaging corporate open source avoidance as a SaaS product. The premise: deploy "legally-trained robots" to recreate any open source dependency from public documentation alone — READMEs, API specs, type definitions, never source code — and deliver the result under the invented MalusCorp-0 license, offering "zero attribution, zero copyleft, and zero obligations."
The parody is specific enough to sting. Output samples show react becoming m-react, lodash becoming m-lodash, all freshly minted under MC-0. Testimonials from "Chad Stockholder, Engineering Director, Profit First LLC" and "Patricia Bottomline, VP of Legal, MegaSoft Industries" read less like punch lines and more like transcriptions. The guarantee to relocate corporate HQ to international waters if any infringing code is discovered is the one flourish that outpaces what real legal teams have actually tried — though not by much.
The legal question underneath all of this isn't resolved. Clean room methodology has a decades-long track record in hardware and software disputes, but it was built around human engineers — isolated teams, documented firewalls, signed NDAs. Whether the same defense holds when the analysis unit is a language model generating "legally distinct" code at scale from documentation it encountered during training hasn't been tested in court. The difference isn't cosmetic: an LLM's relationship to its training data raises derivation questions that human clean room processes were never designed to answer.
Malus leans into the agentic workflow aesthetic deliberately — isolated analysis units, firewall-separated build teams, automated manifest processing across npm, PyPI, Cargo, Maven — because that's precisely what makes the parody cut both ways. It's skewering AI SaaS product theater as much as it's skewering corporate legal strategy. The name means "bad" in Latin and doubles as the apple genus, which tells you where its sympathies lie. What it can't tell you is whether the thing it's parodying is already happening at companies that just haven't put up a website about it.