Skip to content

v0.4.0 — bin resolution, payload decoding, --deep

Choose a tag to compare

View all tags
@Booyaka101 Booyaka101 released this 21 Jul 13:39
v0.4.0
6b5fabf

Three of the tool's documented limitations are now closed in code:

  • Cross-package bin resolution — husky install-style scripts are no longer conservatively HIGH. When a lockfile package with the same name owns the bin, its actual bin script is fetched and analyzed, and the row is re-scored on real evidence: bin: husky install → husky@9.1.7 plus what the script actually does.
  • Payload decoding — base64 / char-code / eval'd literal payloads are decoded (strict-parse gated, depth-capped) and re-analyzed. Obfuscation findings now show what the hidden code does, not just that it hides. Runtime-assembled payloads remain flagged-but-opaque.
  • --deep (CLI flag + Action input deep) — bare require()s from install-script code resolve into the matching lockfile package's entry file, one level deep, closing the curated-helper-list gap for in-tree helpers.

The remaining limitation is the fundamental one, kept on purpose: static capability detection, not proof of malice.

54 tests green. See CHANGELOG.md.

Assets 2
Loading