This release focuses on end-user usability and improved XCSSET detection. We removed nearly all of the output spam related to dependency fetching and analysis, and we added better support for detecting build-time infections. We hope you enjoy it!
- Scan states each distinct dependency outcome once, so a dependency named by forty manifests no longer fails forty identical times.
- Scan skips URL templates nobody ever filled in (
.../download/v{version}/{},%s,$VERSION), which could only ever return 404s. - Nested hostile archives render each package's top trait findings inline.
- cleave v2.10.0 draws one row of neighbouring bytes around a match — two if it's hostile — instead of the full 256-byte capture window.
- Trait rules now follow nested encoding chains, so base64 wrapped in base64 no longer hides what's inside it.
- Xcode
.pbxprojand CMake files are recognized and usable as rule targets, which is where XCSSET-style build-time infections live. - cleave and filefacts v1.6.0 identify YAML, OpenPGP signatures, SquashFS images, Snap packages and Flatpak bundles.
- stng v1.11.0 decodes hex runs embedded inside larger strings —
the
echo <hex> | xxd -r -p | shdropper shape. - fletch v1.2.1 verifies legacy SHA-1 and Go
h1:pins against fetched bytes instead of reporting them as unverifiable. ?full=1returns the complete report from the analyze endpoints, and?refresh=1replaces a standing local verdict.
Release notes: scan v2.10.0 · cleave v2.10.0 · stng v1.11.0 · filefacts v1.6.0 · fletch v1.2.1
brew upgrade atomdrift-project/tap/cleave atomdrift-project/tap/scan atomdrift-project/tap/stng