Skip to content

v0.18.0 — EtherHiding detection, calibration benchmark, path to 1.0

Choose a tag to compare

View all tags
@adamsjack711-ux adamsjack711-ux released this 11 Jul 15:40
v0.18.0
5fbeaab

Added

  • EtherHiding / on-chain command-channel detection (onchain-c2-loader) — a blockchain-state read (eth_getTransactionByHash, TronGrid/Aptos tx endpoints, EVM seed RPCs) co-located with a code executor blocks as the EtherHiding shape; chain-read + raw calldata extraction without a visible executor is review; plain status reads stay safe.
  • Hidden self-node -e execution detection — eval-by-subprocess; paired with windowsHide/detached/stdio:'ignore' it blocks as a silent stage-2 executor.
  • Calibration benchmark (benchmark/run.js) — 30-fixture advisory-modeled corpus with hard CI gates (0 false blocks, 0 full misses).
  • Self-guarding release workflow — this release was published by CI after tests + benchmark + pkgxray's own supply-chain guard over the packed artifact, with npm provenance.
  • Path-to-1.0 freeze — JSON output schema + exit-code mapping pinned by contract tests; Node 18/20/22/24 CI matrix; mcp, mcp-proxy, and the cache server graduated to Stable; canary sandbox hardened with a documented threat model.

Fixed

  • MCP spawn PATH resolution — bare stdio commands resolve in the parent; launchers outside the fixed system dirs no longer fail ENOENT; child env stays fully scrubbed.
  • Provenance-verified self-scan reports REVIEW, not BLOCK — verification-gated on npm↔GitHub parity; typosquats/forks/tampered tarballs keep the full verdict.
  • MCP server reports the real package version (was hardcoded at 0.12.0).
  • Exec-snippet null crash on encoded child_process payloads.
  • node-ipc-style in-place file corruption (logic bomb) now caught.

Full details in CHANGELOG.md.

Assets 2
Loading