v2.0.4

Bug fixes and improvements

• Fix RST syntax by @miketheman in #453
• FP npm-install-script - exclude case by @sobregosodd in #452
• FN: Adding a new detection case to npm-exec-base64 by @sobregosodd in #456

Chores

• Updating top packages list for typosquatting by @sobregosodd in #451
• Bump setuptools from 73.0.1 to 74.1.2 by @dependabot in #455
• Bump pyyaml from 6.0.1 to 6.0.2 by @dependabot in #450
• Bump configparser from 7.0.0 to 7.1.0 by @dependabot in #449

New Contributors

• @miketheman made their first contribution in #453

Full Changelog: v2.0.3...v2.0.4

v2.0.3

Bug fixes and improvements

• Bugfix: obfuscation False Positive by @sobregosodd in #445
• Fix YARA execution bugs by @sobregosodd in #444

Chores

• Bump setuptools from 70.3.0 to 73.0.1 by @dependabot in #447
• Bump mypy from 1.11.0 to 1.11.2 by @dependabot in #446
• Bump flake8 from 7.1.0 to 7.1.1 by @dependabot in #438
• Bump coverage from 7.6.0 to 7.6.1 by @dependabot in #436
• Bump prettytable from 3.10.2 to 3.11.0 by @dependabot in #441

Full Changelog: v2.0.2...v2.0.3

v2.0.2

Bug fixes and improvements

• Adding new patterns to detect obfuscation by @sobregosodd in #435
• Adding new link domains to shady-links by @sobregosodd in #434

Chores

• Bump pytest from 8.2.2 to 8.3.2 by @dependabot in #428
• Bump mypy from 1.10.1 to 1.11.0 by @dependabot in #424
• Bump prettytable from 3.10.0 to 3.10.2 by @dependabot in #417
• Bump coverage from 7.5.4 to 7.6.0 by @dependabot in #418
• Bump pygit2 from 1.15.0 to 1.15.1 by @dependabot in #410
• Update top pkgs resources for NPM and PYPI by @sobregosodd in #433

Full Changelog: v2.0.1...v2.0.2

v2.0.1

Bug fixes and improvements

• Standardize local scanning behavior by @ikretz in #426
• Eliminate Package class by @ikretz in #422
• Bugfix: Adding permissions to traverse extracted files and folders by @sobregosodd in #421
• Removing npm-install-script False Positives by @sobregosodd in #429
• Expand allowed tar archive compression algorithms by @ikretz in #430
• Improve shady-links rule by @sobregosodd in #431

v2.0.0

What's Changed

New features:

• Adding support for running YARA and private rules by @sobregosodd in #401
• Support Go ecosystem by @juliendoutre in #413

Improvements and bugfixes:

• Improve DLL hijacking rule coverage by @ikretz in #414
• Add detection for Python sqlite3 data exfiltration by @ikretz in #420
• Remove duplicated sourcode findings by @sobregosodd in #407
• Simplify local target checks by @ikretz in #419

Chores:

• add setuptools to dependencies by @xopham in #412
• Bump disposable-email-domains from 0.0.103 to 0.0.104 by @dependabot in #409
• Bump certifi from 2023.7.22 to 2024.7.4 by @dependabot in #408

New Contributors

• @ikretz made their first contribution in #414

Full Changelog: v1.11.2...v2.0.0

v1.11.2

What's Changed

• Hotfix: No rules are ran by default by @sobregosodd in #406

Full Changelog: v1.11.1...v1.11.2

v1.11.1

What's Changed

• Fix rules filtering by @sobregosodd in #405

Full Changelog: v1.11.0...v1.11.1

v1.11.0

What's Changed

Bug fixes and improvements

• Add steganography for NPM by @sobregosodd in #396
• Add exceptions to shady-links by @sobregosodd in #395
• Improve detection to avoid memory over-usage by @sobregosodd in #400
• Bugfix: Input rules are not correctly set in analyzers by @sobregosodd in #399

Chores

• Bump mypy from 1.10.0 to 1.10.1 by @dependabot in #402
• Bump setuptools from 70.0.0 to 70.2.0 by @dependabot in #403
• Bump coverage from 7.5.3 to 7.5.4 by @dependabot in #398

Full Changelog: v1.10.1...v1.11.0

v1.10.1

Bug fixes and improvements

• Fixing the timezone in dns lookups by @sobregosodd in #385
• add --version flag to cli by @xopham in #392
• Create RELEASING.md by @christophetd in #393
• Addressing fixes in DLL hijacking by @sobregosodd in #384
• Bugfix Bundled binary rule by @sobregosodd in #386

Chores

• Bump urllib3 from 2.2.1 to 2.2.2 by @dependabot in #391
• Bump flake8 from 7.0.0 to 7.1.0 by @dependabot in #390

New Contributors

• @xopham made their first contribution in #392

Full Changelog: v1.10.0...v1.10.1

v1.10.0

What's Changed

Improvements and bug fixes:

• Add exception for wrong JSFuck detection by @sobregosodd in #383
• Add DLL hijacking detection by @sobregosodd in #382
• Feature: honor requirements versions by @sobregosodd in #380
• Fixing the timezone in dns lookups by @sobregosodd in #379

Chores:

• Bump pytest from 8.2.1 to 8.2.2 by @dependabot in #381

Full Changelog: v1.9.0...v1.10.0