v1.0.4 — MCP Registry listing

pkgxray is now on the MCP Registry as io.github.adamsjack711-ux/pkgxray.

• New pkgxray mcp-server command runs pkgxray as a stdio MCP server; hosts can launch it zero-install with npx -y pkgxray mcp-server (the pkgxray-mcp bin is unchanged).
• Adds mcpName for registry ownership verification.
• No detection, dependency, or verdict changes.

See the CHANGELOG for details.

1.0.3 — a shorter, sharper README

In plain terms: docs-only release. The package's code is identical to 1.0.2 — this exists so the npm page picks up the condensed README.

What changed

• The README is ~40% shorter (458 → 277 lines) with nothing lost: the statistics essay became one sentence, six feature subsections merged into the "What it catches" table plus a short "Beyond detection" list, and everything cut is still one link away in docs/.
• npm renders it correctly now. GitHub-only [!NOTE] alert boxes — which show up as literal [!NOTE] text on npm — were rewritten as plain prose, and a dead in-page link to the comparison table was fixed.
• The project website's source now lives in the repo (website/), with social-share card images. This doesn't affect the npm package contents.
• No code, dependency, or behavior changes of any kind.

1.0.2 — the README shows itself working

Docs-only release — the package's code is identical to 1.0.1. This exists so the npm page picks up the new README, whose old screenshots pointed at files that no longer exist in the repo.

• The hero is now a live recording: an animated GIF of real pkgxray guard runs — express clearing, then a trojaned sample (modeled on the 2024 @solana/web3.js compromise) blocked with cited evidence — plus a 60-second MP4 walkthrough.
• Every capture shares one warm terminal theme, including the re-captured MCP-proxy and hookshot stills (now unedited live sessions) and the browser extension popup.
• No code, dependency, or behavior changes of any kind.

v1.0.1 — a safer canary "detonation" sandbox

In plain terms: pkgxray normally inspects a package without running it. The optional pkgxray canary command is the one exception — you opt in, and it actually runs a package's install scripts inside a locked room to watch what they do. The room is seeded with fake passwords, and all network traffic is routed into a recorder that never lets it out — so if a package tries to steal a secret and phone home, we catch it red-handed.

This release makes that locked room genuinely locked. A review found several ways a sneaky package could slip out or hide; this closes them. Only the opt-in canary command is affected — nothing else changes.

What got safer

• Catches disguised secret theft. We used to only spot a stolen fake password if it was sent as-is; if the package scrambled it first (base64/hex), we missed it. Now we check the common disguises too.
• The room actually blocks the internet (macOS). A package could previously open its own direct connection and sneak data out around our recorder. On macOS that escape route is now blocked at the operating-system level, while the internal recorder stays reachable.
• Your real secrets are hidden (Linux). The sandbox used to leave your actual ~/.aws, ~/.ssh, and ~/.npmrc readable. Now they're hidden behind an empty folder — the package only ever sees the fakes.
• A runaway package can't wreck the machine. The tested code now runs with limits on CPU time, file size, and crash dumps.

What got fixed

• A package can no longer freeze the scan by holding a network connection open forever.
• A clean result is now labelled honestly. Watching a package once can only catch bad behaviour, never prove it's safe (clever malware stays quiet when it senses it's watched). So a clean run now says not-observed ("we didn't see anything this time") instead of safe. The normal, non-canary scan is unchanged.
• Odd folder names can't break the sandbox rules (paths are now escaped safely).

Full notes: CHANGELOG.md. Published to npm with build provenance.

v1.0.0 — 0 false blocks at scale; the stability contract is in force

The final item on the path to 1.0 is complete: the "0 false blocks" claim is now proven against real packages nobody wrote as a test, not just a curated corpus. Every box on the checklist is checked, so the compatibility contract now binds — a breaking change to a Stable surface requires a major bump.

Added

• Top-1000 validation harness (scripts/validate-at-scale.js, validation/) — runs pkgxray guard over the 1,000 most-depended-upon npm packages and gates on 0 heuristic false blocks. Zero-dependency, reproducible against a committed corpus. Correct known-CVE blocks (26) and audited defensible blocks (pm2 genuinely installs boot persistence) are separated out. The first run surfaced 22 false blocks across ~7 detectors — all calibrated, each locked in as a benign benchmark fixture.

Fixed — calibration false blocks (all now review/safe)

• Dual-use URL shorteners — a goo.gl/bit.ly in an error/doc link no longer escalates to a HIGH exfil block; only a hardcoded IP or a no-legitimate-use paste/webhook/OAST domain does.
• Shell tab-completion installers — <tool> completion >> ~/.bashrc is reviewed, not blocked. Crontab / systemd / launch-agent / Run-key writes still BLOCK.
• Transform test-fixtures — a .txt/.md fixture read + vm in a test/ path gets the test-path downgrade; opaque payload blobs (.dat/.bin/.enc) still stay HIGH even in tests. b.require(x) (browserify's bundler API) no longer matches the dynamic-require exfil shape.
• Large legitimate bundles — decode→execute now requires decoder and executor within ~600 chars, and the base64 DECODE regex no longer matches the ENCODE form .toString("base64").
• Build artifacts — a generic code-execution/dynamic-require in a file diverging from git source (fesm bundles, Babel .bc.js, r.js) no longer correlates to a tamper block; a genuine injected conduct payload still does.
• Comments are no longer read as conduct — example IPs, license URLs in binding.gyp, and org links no longer fire detectors; doc-site bundles get the non-runtime downgrade.
• A 404 GitHub repo is REVIEW, not BLOCK — indistinguishable from a typosquat's fake link on the 404 alone.

Hard malware signals unchanged: benchmark recall holds at 89.5%, 0 full misses, full suite 512/512.

Full details in CHANGELOG.md.

v0.18.0 — EtherHiding detection, calibration benchmark, path to 1.0

Added

• EtherHiding / on-chain command-channel detection (onchain-c2-loader) — a blockchain-state read (eth_getTransactionByHash, TronGrid/Aptos tx endpoints, EVM seed RPCs) co-located with a code executor blocks as the EtherHiding shape; chain-read + raw calldata extraction without a visible executor is review; plain status reads stay safe.
• Hidden self-node -e execution detection — eval-by-subprocess; paired with windowsHide/detached/stdio:'ignore' it blocks as a silent stage-2 executor.
• Calibration benchmark (benchmark/run.js) — 30-fixture advisory-modeled corpus with hard CI gates (0 false blocks, 0 full misses).
• Self-guarding release workflow — this release was published by CI after tests + benchmark + pkgxray's own supply-chain guard over the packed artifact, with npm provenance.
• Path-to-1.0 freeze — JSON output schema + exit-code mapping pinned by contract tests; Node 18/20/22/24 CI matrix; mcp, mcp-proxy, and the cache server graduated to Stable; canary sandbox hardened with a documented threat model.

Fixed

• MCP spawn PATH resolution — bare stdio commands resolve in the parent; launchers outside the fixed system dirs no longer fail ENOENT; child env stays fully scrubbed.
• Provenance-verified self-scan reports REVIEW, not BLOCK — verification-gated on npm↔GitHub parity; typosquats/forks/tampered tarballs keep the full verdict.
• MCP server reports the real package version (was hardcoded at 0.12.0).
• Exec-snippet null crash on encoded child_process payloads.
• node-ipc-style in-place file corruption (logic bomb) now caught.

Full details in CHANGELOG.md.