Skip to content

SessionDock distribution hold — 2026-08-04

Choose a tag to compare

View all tags
@Makmatoe Makmatoe released this 04 Aug 00:37
· 6 commits to main since this release
Immutable release. Only release title and notes can be modified.
security-hold-20260804
d4a5eb9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Distribution withdrawn — 2026-08-04

Do not download, restore, allow, or run current SessionDock binaries from mirrors, Discord attachments, browser caches, or another computer. Do not disable Microsoft Defender or add an exclusion.

A separately shared unsigned integrated-test executable using SessionDock's retired compressed single-file layout was detected as Trojan:Win32/Wacatac.B!ml after an Internet-origin download. Its SHA-256 is 8041C3268B698A2F964654B7B0C5F67BC2B2B1035E44AB767D9074F498612B28. The Discord bytes exactly matched the local development artifact, ruling out byte-level transport modification, but Microsoft has not yet determined that the detection is incorrect.

The former canonical v3.0.0 assets were not the exact detected development file. They were withdrawn because they were also unsigned, used the same heuristic-sensitive packed layout, and do not meet the new trusted-publisher release gate. The former Setup SHA-256 was 04CCFF322788E3E9954C1DF5CB57CD156E26253BE7B6B093FA151273050DD6AA; the former portable ZIP SHA-256 was 410E5C9C453BB1768E06CABC5951D1C1A75517599395302CFB0DECB3F282DDE4.

No executable or package is attached to this security notice. The v3.0.0 source tag remains for audit. A replacement will be published only after transparent multi-file inventory verification, trusted Authenticode signing and timestamping, ExactWheel provenance/licensing approval, Defender review, staging, attestation, and public re-download verification all pass.

See the repository security policy and docs/DEFENDER_DETECTION_RESPONSE.md before handling any saved copy.

Assets 3
Loading