unsus 0.2.1 preview

Saved project reports now work with unsus explain project.json. The command renders the original report without rescanning or executing package code.

Project text now shows each package’s risk, representative warning evidence with observed locations, and omitted text files. Repeated finding types are grouped; JSON retains every finding and full coverage details. Detection, policy thresholds, scan limits and scan exit codes are unchanged.

Requires Node.js 22+. Download the archive and checksum, verify with shasum -a 256 -c unsus-0.2.1.tar.gz.sha256, extract it and run ./unsus-0.2.1/bin/unsus --help. Keep the whole extracted kit together.

Validated with 60 tests, six synthetic cases, extracted-kit checks and a real installed-dependency replay that preserved all JSON findings, coverage and policy decisions.

unsus 0.2.0 preview

Adds static SARIF 2.1.0, explicit report formats, atomic output files and consistent structured operational errors. Registry selection now works consistently across scan, diff and guarded install.

The new offline unsus project command inspects installed direct dependencies and reports unresolved, omitted and failed coverage explicitly. It does not install/execute packages, verify lockfile integrity or scan transitive dependencies. Boundaries and exit policy are documented in the README.

Passive Unicode range and word tables retain their entropy findings but no longer trigger a block from those tables plus lifecycle/URL noise alone. Observed execution, decoding and network behavior retain full scoring. This remains a heuristic preview, not a safety certificate.

Requires Node.js 22+. Download the tarball and matching SHA-256 file, verify the checksum, extract it and run bin/unsus --help. Compiled code and locked runtime dependencies are included; npm publication is not required.

Validation: 59 tests, six bounded synthetic cases, independent review, verified extracted kit, and a real offline scan of all three production dependencies. The real scan completed with complete selected direct coverage and warning status; all findings remained visible. GitHub CI passed on the final feature commit. No external dependency upgrades.

unsus 0.1.0 preview

The first downloadable unsus preview: inspect a direct npm package before installing it, and keep npm lifecycle scripts disabled.

Download the archive and checksum below. Requires Node.js 22+; compiled code and runtime dependencies are included, so there is no build step or dependency on npm publication.

shasum -a 256 -c unsus-0.1.0.tar.gz.sha256
tar -xzf unsus-0.1.0.tar.gz
./unsus-0.1.0/bin/unsus --help

Move the whole extracted directory somewhere permanent before adding its bin directory to PATH. The kit supports scan, diff, explain, guarded install, --version, and per-command help. Local static scans work offline; registry scans require network access and installs require npm.

This preview scans the direct package only. Dependencies are not scanned, heuristic results are not safety guarantees, and Docker observation is experimental. Read the README for supported registry behavior and the .unsus/artifacts/ files that guarded installs retain.

Verified: existing test suite 51/51, extracted-kit commands and blocking exits, PATH symlink launch on macOS, and Linux CI. Windows instructions are included but Windows execution has not been tested. npm registry publication remains separate.