Skip to content

v0.9.5

Choose a tag to compare

View all tags
@tstromberg tstromberg released this 24 Jul 05:16
v0.9.5
0db5755

Features

  • Added Debian package metadata: package, version, architecture, maintainer, dependencies, and installed size.
  • Added RubyGems metadata: name, version, platform, authors, licenses, homepage, and runtime deps.
  • Split package ecosystems into distinct types, including Android/Alpine APK, npm, crate, conda, NuGet, IPA,
    VSIX, FreeBSD pkg, and Arch pkg.
  • Added PE/.NET signals for managed resource entropy/size, suspicious VERSIONINFO identity text, .reloc
    overhang, and certificate table size.
  • Improved AppleScript detection for plaintext macOS stealer scripts with random or unknown extensions.

Performance

  • Reuses parsed PE/ELF/Mach-O objects for string extraction instead of parsing binaries twice.
  • Skips duplicate stng symbol/import extraction because filefacts already walks symbols itself.

Bugfixes

  • Hardened AST analysis against deeply nested source chains that could overflow the worker stack.
  • Emits ast.depth_capped when hostile or generated source exceeds analysis depth.
  • Reduced false positives by treating Vim, Lisp, SQL, Smali, diffs, and TS baseline files as text.
  • Fixed archive disambiguation so legitimate .apk and .pkg ecosystem variants do not look like extension
    mismatches.
Assets 2
Loading