Skip to content

v2.2.0

Choose a tag to compare

View all tags
@tstromberg tstromberg released this 24 Jul 05:16
v2.2.0
c8f9b60

Features

  • Bloom-filter matching — scans consult bloom filters before doin work: known-good & known-bad, known-good samples are skipped by default. Tune with --mode: fast (bloom only), balanced default), or slow (always full scan).
  • Dependency fetchin by default — interactive scans fetch and scan a sample's declared dependencies and install-command packages
  • Renamed CLI to atomscan (avoids clashing with avast's scan); fs→path, pkg→purl (old names aliased).
  • New "purl" subcommand: purl npm/left-pad@1.3.0 scans a package straight from its PURL.
  • New "url" subcommand to scan a remote URL
  • Adaptive --interpret templates
  • Auto-refreshes rules/models when stale (--no-update to disable); --hopper upload in server mode; --show=all keeps all archive members.
  • Handles registry records, provenance, and local references, including offline registry maps.

Fixes

  • Recalibrated thresholds (hostile L25, suspicious L3000); confident-but-opaque ML "hostile" held at suspicious, not cleared.
  • Fixed bloom bucket loading, progress-bar glitches, FreeBSD build, and tar.gz extraction.
  • Removed obsolete flags (--slow-rule-ms, --models-repo, --no-update-check).

Performance

  • Caches fetched-dependency analysis by content hash, skipping repeat disassembly across scans.
  • Parallel dependency fetching and scanning.
Assets 2
Loading