Five things to see, ordered by how early you have to get up.
A live volcano inside the caldera of a bigger, dead one. You leave Malang in the dark, stand on a cold ridge at Penanjakan, and watch the sun come up over a sea of sand with three cones standing in it. Bring a jacket; it is close to freezing at the viewpoint.
In 2016 a group of students painted an entire riverside kampung in every color they could buy. It worked: the village now charges a small entry fee and the money maintains it. The bridge between Jodipan and Tridi has a glass floor, which is either the best or the worst part.
The colonial boulevard. Walk it on a Sunday morning when the road closes to cars and the whole city is out buying snacks.
A separate small city up the hill: apple orchards, hot springs, and an enormous theme park that is visible from most of the valley.
Balekambang, Ngliyep, Sendang Biru. Indian Ocean beaches with real surf and very few people. The road is slow and worth it.