Pull requests

• fix(sourcecode): catch reverse-shell patterns that span newlines

  #912·choksi2212 opened Oct 20, 2026·

  ·
  1

• Document JSON output and add a JSON Schema for it

  #910·GodfredArhinful opened Oct 19, 2026·

  ·
  1

• fix(deps): vuln joi (patch → 17.13.8) [tests/core/resources/package.json]

  adms-dependency-updateadms-high-severityadms-medium-severityadms-mode-all-vulnsadms-npmadms-patch-updatebot_family:adms-dependency-updatecampaigner-automated-change
  #909·gh-worker-campaigns-3e9aa4[bot] opened Oct 19, 2026Bot·4 tasks·

  ·
  1

• fix(deps): vuln urllib3 (minor → 2.8.0) [pyproject.toml]

  adms-dependency-updateadms-high-severityadms-medium-severityadms-minor-updateadms-mode-all-vulnsadms-pythonbot_family:adms-dependency-updatecampaigner-automated-change
  #908·gh-worker-campaigns-3e9aa4[bot] opened Oct 19, 2026Bot·4 tasks·

  ·
  1

• fix(cli): treat a failed package download as an incomplete scan

  #907·choksi2212 opened Oct 18, 2026·

  ·
  1

  1

• fix(rules): stop false positives on compiler-generated code (pdfjs-dist Emscripten/Brotli/core-js)

  #904·choksi2212 opened Oct 11, 2026·

  ·
  1

  1

• Bump disposable-email-domains from 0.0.237 to 0.0.274

  choredependencies
  #902·dependabot[bot] opened Oct 6, 2026Bot·

  ·
  1

• Bump black from 26.5.1 to 26.10.0

  choredependencies
  #901·dependabot[bot] opened Oct 6, 2026Bot·

  ·
  1

• Bump mypy from 2.3.1 to 2.4.0

  choredependencies
  #900·dependabot[bot] opened Oct 6, 2026Bot·

  ·
  1

• Bump boto3 from 1.43.72 to 1.43.108

  choredependencies
  #899·dependabot[bot] opened Oct 6, 2026Bot·

  ·
  1

• Bump pytest-mock from 3.15.1 to 3.16.0

  choredependencies
  #895·dependabot[bot] opened Sep 29, 2026Bot·

  ·
  1

• Bump flake8 from 7.3.0 to 7.4.1

  choredependencies
  #893·dependabot[bot] opened Sep 29, 2026Bot·

  ·
  1

• Bump coverage from 7.15.4 to 7.16.2

  choredependencies
  #891·dependabot[bot] opened Sep 29, 2026Bot·

  ·
  1

• Bump urllib3 from 2.7.0 to 2.8.0

  choredependencies
  #886·dependabot[bot] opened Sep 22, 2026Bot·

  ·
  1

• Scan extension-less entry points using their shebang

  #885·VictorMartins3 opened Sep 17, 2026·

  ·

• Detect fs reads reached through a destructured or named import

  #884·VictorMartins3 opened Sep 17, 2026·

  ·

• Match the node: prefix and template-literal specifiers

  #883·VictorMartins3 opened Sep 17, 2026·

  ·

• Bump click from 8.4.2 to 8.5.0

  choredependencies
  #877·dependabot[bot] opened Sep 1, 2026Bot·

  ·
  1

• Bump nono-py from 0.15.0 to 0.16.0

  choredependencies
  #876·dependabot[bot] opened Sep 1, 2026Bot·

  ·
  1

• fix(rules): require word boundary for PowerShell DownloadFile pattern

  #872·STiFLeR7 opened Aug 31, 2026·

  ·
  1

• fix(rules): require whitespace/paren boundary for JS eval in obfuscation rules

  #871·STiFLeR7 opened Aug 31, 2026·

  ·
  1

  3

• fix(npm): reject package-lock.json in npm verify with a clear error

  #870·sidsri14 opened Aug 29, 2026Contributor·

  ·
  1

• feat(rules): detect scripts written to disk and executed

  #862·gitmehdii opened Aug 18, 2026·

  ·
  1

• fix(analyzer): prevent triple quote false negatives

  #861·ShreeVakthi18 opened Aug 18, 2026·

  ·
  1

• fix: suppress non-fatal whois socket timeout noise from normal output

  #850·surajthedev opened Aug 12, 2026·

  ·
  1

  7