https://chain305.com/ Guides, comparisons and attack teardowns from Chain305, plus releases of Chainsaw, the package firewall. en Mon, 02 Nov 2026 12:00:00 GMT https://chain305.com/learn/install-script-attacks/ https://chain305.com/learn/install-script-attacks/ Mon, 02 Nov 2026 12:00:00 GMT How npm, PyPI, Cargo and Composer run code at install time, the 2026 attacks that abused each hook, which settings help, and what those settings miss. https://chain305.com/learn/maintainer-account-takeover/ https://chain305.com/learn/maintainer-account-takeover/ Mon, 02 Nov 2026 12:00:00 GMT How attackers publish malicious versions from hijacked accounts, stolen tokens and trusted publishing, the signals that give them away, and how a hold helps. https://chain305.com/teardowns/pgserve-canistersprawl-npm/ https://chain305.com/teardowns/pgserve-canistersprawl-npm/ Fri, 30 Oct 2026 12:00:00 GMT How pgserve 1.1.11 to 1.1.14 shipped a postinstall stealer that republished itself with stolen npm tokens, and whether Chainsaw refuses it on day 0. https://chain305.com/teardowns/velora-dex-sdk-npm-compromise/ https://chain305.com/teardowns/velora-dex-sdk-npm-compromise/ Fri, 30 Oct 2026 12:00:00 GMT How @velora-dex/sdk 9.4.1 piped a base64 command to bash on import to plant a macOS backdoor, and whether Chainsaw refuses it on first download, on day 0. https://chain305.com/teardowns/durabletask-pypi-compromise/ https://chain305.com/teardowns/durabletask-pypi-compromise/ Fri, 30 Oct 2026 12:00:00 GMT How malicious durabletask 1.4.1 to 1.4.3 reached PyPI, what the Linux dropper fetched and ran on import, and whether Chainsaw refuses them on day 0. https://chain305.com/teardowns/laravel-lang-tag-rewrite/ https://chain305.com/teardowns/laravel-lang-tag-rewrite/ Fri, 30 Oct 2026 12:00:00 GMT How the existing tags of four laravel-lang Composer packages were re-pointed at a credential stealer on 22 May 2026, and whether Chainsaw refuses it on day 0. https://chain305.com/teardowns/onering-crates-build-script/ https://chain305.com/teardowns/onering-crates-build-script/ Fri, 30 Oct 2026 12:00:00 GMT How malicious onering 1.4.1 reached crates.io, how its build.rs sent each build's latest commit and diff to Sentry, and whether Chainsaw refuses it on day 0. https://chain305.com/vs-depgate/ https://chain305.com/vs-depgate/ Fri, 30 Oct 2026 12:00:00 GMT DepGate is an MIT-licensed, self-hosted dependency gateway for 8 ecosystems. Where it is stronger, where Chainsaw differs, and how to test both on your code. https://chain305.com/vs-endor-labs/ https://chain305.com/vs-endor-labs/ Fri, 30 Oct 2026 12:00:00 GMT Endor Labs Package Firewall and Chainsaw both refuse bad packages at install. Where Endor is stronger, where Chainsaw differs, and how to test both yourself. https://chain305.com/vs-aikido-safe-chain/ https://chain305.com/vs-aikido-safe-chain/ Fri, 30 Oct 2026 12:00:00 GMT Aikido Safe Chain and Chainsaw both block malicious npm and PyPI installs free, with no account. Where Safe Chain is stronger and where Chainsaw goes further. https://chain305.com/vs-safedep-pmg/ https://chain305.com/vs-safedep-pmg/ Fri, 30 Oct 2026 12:00:00 GMT SafeDep PMG and Chainsaw block malicious packages at install. Where PMG is stronger, including its sandbox, where Chainsaw differs, and how to test both. https://chain305.com/vs-bytesafe/ https://chain305.com/vs-bytesafe/ Fri, 30 Oct 2026 12:00:00 GMT Bytesafe and Chainsaw both refuse risky packages on the install path. Where Bytesafe is stronger, where Chainsaw differs, and how to test both side by side. https://chain305.com/teardowns/telnyx-pypi-compromise/ https://chain305.com/teardowns/telnyx-pypi-compromise/ Thu, 29 Oct 2026 12:00:00 GMT How malicious telnyx 4.87.1 and 4.87.2 reached PyPI, what the stealer hidden in a WAV file took on import, and whether Chainsaw refuses them on day 0. https://chain305.com/teardowns/node-ipc-expired-domain/ https://chain305.com/teardowns/node-ipc-expired-domain/ Thu, 29 Oct 2026 12:00:00 GMT How an expired email domain likely handed a dormant node-ipc co-maintainer account to an attacker, what the DNS stealer took, and whether Chainsaw stops it. https://chain305.com/teardowns/miasma-npm-worm/ https://chain305.com/teardowns/miasma-npm-worm/ Thu, 29 Oct 2026 12:00:00 GMT How the Miasma worm hit 32 @redhat-cloud-services packages, ran through binding.gyp and then AsyncAPI imports, and whether Chainsaw would have stopped it. https://chain305.com/teardowns/mastra-npm-compromise/ https://chain305.com/teardowns/mastra-npm-compromise/ Thu, 29 Oct 2026 12:00:00 GMT How 140+ Mastra npm packages gained an easy-day-js dependency whose install script dropped a remote-access tool, and whether Chainsaw stops it. https://chain305.com/teardowns/sap-cap-npm-compromise/ https://chain305.com/teardowns/sap-cap-npm-compromise/ Thu, 29 Oct 2026 12:00:00 GMT How four SAP CAP and mbt npm versions were published with a stolen token and a hijacked workflow, what the Bun payload stole, and whether Chainsaw stops it. https://chain305.com/learn/block-malicious-pypi-packages/ https://chain305.com/learn/block-malicious-pypi-packages/ Thu, 29 Oct 2026 12:00:00 GMT The pip, uv and Poetry settings that stop most malicious PyPI packages: wheels only, hashes, release-age cutoffs, index order, and where a firewall fits. https://chain305.com/learn/dependency-confusion/ https://chain305.com/learn/dependency-confusion/ Thu, 29 Oct 2026 12:00:00 GMT Dependency confusion is a public package taking the place of your private one. How it works in npm, pip, Maven and NuGet, real cases, and the fixes. https://chain305.com/learn/maven-go-cargo-package-security/ https://chain305.com/learn/maven-go-cargo-package-security/ Thu, 29 Oct 2026 12:00:00 GMT Maven mirrors and checksums, Go checksum database and GOPRIVATE, Cargo.lock and source replacement: what each setting stops and where a firewall fits. https://chain305.com/sonatype-repository-firewall-alternative/ https://chain305.com/sonatype-repository-firewall-alternative/ Thu, 29 Oct 2026 12:00:00 GMT When Sonatype Repository Firewall fits, why teams look elsewhere, which alternatives block packages at install time, and how Chainsaw differs from it. https://chain305.com/teardowns/litellm-pypi-compromise/ https://chain305.com/teardowns/litellm-pypi-compromise/ Thu, 29 Oct 2026 12:00:00 GMT How malicious litellm 1.82.7 and 1.82.8 reached PyPI with a token stolen via Trivy, what the payload stole at Python startup, and whether Chainsaw stops it. https://chain305.com/teardowns/bitwarden-cli-npm-compromise/ https://chain305.com/teardowns/bitwarden-cli-npm-compromise/ Thu, 29 Oct 2026 12:00:00 GMT How a malicious @bitwarden/cli 2026.4.0 reached npm through Bitwarden's own CI, what its Bun-staged stealer took, and whether Chainsaw stops it. https://chain305.com/teardowns/trivy-tag-hijack/ https://chain305.com/teardowns/trivy-tag-hijack/ Thu, 29 Oct 2026 12:00:00 GMT How a malicious Trivy 0.69.4 and force-pushed trivy-action tags stole CI secrets from runner memory, and where Chainsaw would have stopped it. https://chain305.com/teardowns/glassworm-hidden-unicode/ https://chain305.com/teardowns/glassworm-hidden-unicode/ Thu, 29 Oct 2026 12:00:00 GMT How GlassWorm hid code in invisible Unicode variation selectors across npm, GitHub and VS Code, how the loader decodes it, and what Chainsaw stops. https://chain305.com/teardowns/proc-macro1-crates-typosquat/ https://chain305.com/teardowns/proc-macro1-crates-typosquat/ Thu, 29 Oct 2026 12:00:00 GMT How a likely compromised account added the typosquat proc-macro1 to arrayref and two other crates, what its build.rs ran, and whether Chainsaw stops it. https://chain305.com/attack-coverage-2026/ https://chain305.com/attack-coverage-2026/ Thu, 29 Oct 2026 12:00:00 GMT We tested 58 public 2026 supply-chain attacks against production Chainsaw: 33 fully covered, 26 of them by default, 16 not stopped, every row listed. https://chain305.com/teardowns/axios-npm-compromise/ https://chain305.com/teardowns/axios-npm-compromise/ Wed, 28 Oct 2026 12:00:00 GMT How malicious axios 1.14.1 and 0.30.4 were published from a hijacked maintainer account, what the dropper installed, and whether Chainsaw stops it. https://chain305.com/learn/ https://chain305.com/learn/ Wed, 28 Oct 2026 12:00:00 GMT Guides to stopping malicious packages at install time: package firewalls, npm settings, typosquatting, slopsquatting, comparisons and real attack teardowns. https://chain305.com/learn/block-malicious-npm-packages/ https://chain305.com/learn/block-malicious-npm-packages/ Wed, 28 Oct 2026 12:00:00 GMT The npm settings that stop most malicious packages: ignore-scripts, min-release-age, npm ci, scoped registries and signatures, and where a firewall fits. https://chain305.com/learn/typosquatting/ https://chain305.com/learn/typosquatting/ Wed, 28 Oct 2026 12:00:00 GMT Typosquatting is publishing malware under a name close to a popular package. Real cases, the patterns attackers use, and how detection catches them. https://chain305.com/vs-github-package-firewall/ https://chain305.com/vs-github-package-firewall/ Wed, 28 Oct 2026 12:00:00 GMT GitHub package firewall is an npm proxy for GitHub Enterprise Cloud, in preview. What it checks, where it is stronger, and where Chainsaw differs. https://chain305.com/vs-socket/ https://chain305.com/vs-socket/ Tue, 27 Oct 2026 12:00:00 GMT Socket and Chainsaw both block malicious packages at install time. Where Socket is stronger, where Chainsaw differs, and how to test both on your own code. https://chain305.com/what-is-a-package-firewall/ https://chain305.com/what-is-a-package-firewall/ Tue, 27 Oct 2026 12:00:00 GMT A package firewall decides on every npm, pip or Maven install whether the package may download. How it works, what it catches, and how it differs from SCA. https://chain305.com/slopsquatting/ https://chain305.com/slopsquatting/ Tue, 27 Oct 2026 12:00:00 GMT Slopsquatting is registering malware under package names that AI coding tools invent. How often models invent names, and how to refuse them at install time. https://chain305.com/jfrog-curation-alternative/ https://chain305.com/jfrog-curation-alternative/ Tue, 27 Oct 2026 12:00:00 GMT When JFrog Curation fits and when teams look elsewhere: the alternatives that block packages at install time, and how Chainsaw differs from Curation. https://chain305.com/self-hosted-package-firewall/ https://chain305.com/self-hosted-package-firewall/ Tue, 27 Oct 2026 12:00:00 GMT Why teams run a package firewall on their own infrastructure, what a self-hosted or air-gapped one must do, and how Chainsaw runs in your VPC or offline. https://chain305.com/teardowns/mini-shai-hulud-tanstack/ https://chain305.com/teardowns/mini-shai-hulud-tanstack/ Tue, 27 Oct 2026 12:00:00 GMT How 84 malicious @tanstack versions were published through hijacked trusted publishing, what the payload stole, and whether Chainsaw would have stopped it. https://chain305.com/changelog/#2026-10-23-four-ways-to-fetch-a-download-past-enforcement-are-closed https://chain305.com/changelog/#2026-10-23-four-ways-to-fetch-a-download-past-enforcement-are-closed Fri, 23 Oct 2026 12:00:00 GMT Security A Range header sent RubyGems and Hugging Face downloads straight upstream, before policy and the malware check; ranged requests now take the same path as plain ones. Composer, CocoaPods and pub download paths must now match a URL the package's own metadata declares, so a hand-built path can no longer fetch one thing while another is judged. Legacy single-name Hugging Face ids and artifact-shaped paths that name no package are judged or refused. Policy exceptions now expire in every org, not only the default one. https://chain305.com/changelog/#2026-10-22-a-seeded-rule-for-known-exploited-vulnerabilities https://chain305.com/changelog/#2026-10-22-a-seeded-rule-for-known-exploited-vulnerabilities Thu, 22 Oct 2026 12:00:00 GMT Added New organizations get a seeded rule that refuses any package carrying a CVE in the CISA Known Exploited Vulnerabilities catalog; existing organizations add it themselves. It applies at any CVSS score, and policies gain an inKev condition. The catalog ships in the image. With no catalog loaded the rule fails closed and refuses every package carrying an advisory. A quarantined version can now be released, and quarantining one needs the repository-manage permission. https://chain305.com/changelog/#2026-10-21-accept-an-existing-vulnerable-backlog-in-one-step https://chain305.com/changelog/#2026-10-21-accept-an-existing-vulnerable-backlog-in-one-step Wed, 21 Oct 2026 12:00:00 GMT Added The exception baseline takes a vulnerability rule and creates one exception per repository, package and version it matches today, each expiring on a per-severity deadline, so turning on a CVE block rule does not break every build on day one. It is a dry run unless you say otherwise. Baseline exceptions never cover a package that is, or later becomes, known-malicious. Malware refusals now also say what matched, such as npm's security placeholder versions. https://chain305.com/changelog/#2026-10-19-helm-chart-for-self-hosted-installs https://chain305.com/changelog/#2026-10-19-helm-chart-for-self-hosted-installs Mon, 19 Oct 2026 12:00:00 GMT Added Chainsaw now has a Helm chart, published at oci://registry-1.docker.io/chain305/chainsaw, with a single-node profile and a high-availability profile (Postgres leader election, S3 blob store, Redis). It never renders a Secret from values, and it includes a backup CronJob, a weekly restore check into a throwaway Postgres and, from chart 0.1.2, encrypted backups. A generic image flavour has no chain305.com URLs or keys baked in. https://chain305.com/changelog/#2026-10-19-fewer-false-typosquat-blocks-in-the-install-guard https://chain305.com/changelog/#2026-10-19-fewer-false-typosquat-blocks-in-the-install-guard Mon, 19 Oct 2026 12:00:00 GMT Changed The offline guard now clears long-established packages before its name-similarity check, so npm install pug no longer blocks. The server uses the same clear rules from v0.22.120. On a 10,428-package inventory, false blocks fell from 28 to 13 and warnings from 345 to 88, with the malware lane unchanged. CHAINSAW_GUARD_MODE=monitor makes typosquat verdicts non-blocking while malware and homoglyph blocks stay on. https://chain305.com/changelog/#2026-10-17-pr-scan-blocks-risky-workflow-changes-a-pull-request-adds https://chain305.com/changelog/#2026-10-17-pr-scan-blocks-risky-workflow-changes-a-pull-request-adds Sat, 17 Oct 2026 12:00:00 GMT Changed From v0.22.108 to v0.22.111, with the Guard Action in block mode, pr-scan fails a pull request that adds a step decoding a payload into a shell, a pull_request_target workflow that runs the PR's code, a comment trigger with no author check, a VS Code task that runs when the folder opens, or a third-party action referenced by tag or branch instead of a commit SHA. Only findings the pull request introduces count, so an existing repository does not fail on what it already has. https://chain305.com/changelog/#2026-10-17-default-block-rule-for-import-time-execution https://chain305.com/changelog/#2026-10-17-default-block-rule-for-import-time-execution Sat, 17 Oct 2026 12:00:00 GMT Added A new seeded rule refuses a package whose code runs a downloaded or decoded payload as soon as it is imported, required or loaded, with no install hook (npm, PyPI, Composer, RubyGems). On release it refused 0 of 860 top npm and PyPI packages. Orgs on chain305.com have it. Self-hosted orgs created before this release need to add it from configs/seed.yaml. https://chain305.com/changelog/#2026-10-17-a-monitor-rule-no-longer-switches-off-a-block-rule-after-it https://chain305.com/changelog/#2026-10-17-a-monitor-rule-no-longer-switches-off-a-block-rule-after-it Sat, 17 Oct 2026 12:00:00 GMT Fixed Policy evaluation stopped at the first matching rule, even a monitor rule, so the seeded rule that monitors versions under 10 days old hid the hidden-Unicode and typosquat block rules ranked after it, for exactly the young versions an attack ships. A monitor match now records and evaluation continues. https://chain305.com/changelog/#2026-10-16-policy-on-git-url-and-other-non-registry-sources https://chain305.com/changelog/#2026-10-16-policy-on-git-url-and-other-non-registry-sources Fri, 16 Oct 2026 12:00:00 GMT Added The install guard and pr-scan now tell policy when a package comes from outside the public registry, whether it is pinned to a full commit SHA or content hash, and where it comes from. A tested two-rule recipe refuses unpinned sources and sources off an allow-list, or reports them in monitor mode. The lockfile scan also flags dependency-confusion risk: a package taken from an undeclared host, with no hash, whose name also exists on the public registry. https://chain305.com/changelog/#2026-10-16-release-hold-for-composer-and-a-longer-hold-on-risky-npm-cha https://chain305.com/changelog/#2026-10-16-release-hold-for-composer-and-a-longer-hold-on-risky-npm-cha Fri, 16 Oct 2026 12:00:00 GMT Added The release-age hold now covers Composer, so composer update resolves to a version that is old enough. An npm version that first gains an install script, or grows more than 20 times in unpacked size, is held longer. A Composer version older than 7 days whose tag is re-pointed to a different commit keeps the cached copy, and binding.gyp is treated as the install hook npm runs. https://chain305.com/changelog/#2026-10-15-registry-mirrors-judged-by-content-hash https://chain305.com/changelog/#2026-10-15-registry-mirrors-judged-by-content-hash Thu, 15 Oct 2026 12:00:00 GMT Added A Cargo.lock package pulled through Artifactory, Nexus or another mirror used to read as unknown. The lockfile scan now compares its checksum with the public release: a match is scored as the public package, a mismatch is flagged high as tampering or dependency confusion. Orgs declare their mirror hosts in settings. https://chain305.com/changelog/#2026-10-10-48-hour-release-age-hold-on-by-default-for-npm-and-pypi https://chain305.com/changelog/#2026-10-10-48-hour-release-age-hold-on-by-default-for-npm-and-pypi Sat, 10 Oct 2026 12:00:00 GMT Changed For every org that has not set its own hold, the proxy now hides npm and PyPI versions published less than 48 hours ago, so version ranges resolve to the newest older version instead of breaking the build. A lockfile pin to a held version is refused with a message naming the newest allowed version. A version that fixes an advisory affecting the newest allowed one is released straight away. Opt out per org with release_min_age_hours: 0. https://chain305.com/changelog/#2026-10-06-one-command-installs-the-cli-and-turns-the-guard-on https://chain305.com/changelog/#2026-10-06-one-command-installs-the-cli-and-turns-the-guard-on Tue, 06 Oct 2026 12:00:00 GMT Added install.sh and install.ps1 now run chainsaw guard init --install after installing, so the install guard is active without a second step. It is skipped when CHAINSAW_NO_GUARD or CI is set, and a guard failure never fails the install. On Windows, if the execution policy stops profiles loading, the installer says the guard is not active and prints the command to fix it, without changing the policy itself. https://chain305.com/changelog/#2026-10-05-per-seat-team-plan-replaces-the-flat-pro-plan https://chain305.com/changelog/#2026-10-05-per-seat-team-plan-replaces-the-flat-pro-plan Mon, 05 Oct 2026 12:00:00 GMT Changed Team costs $25 per seat per month, or $240 per seat per year, for 5 to 100 seats. A seat is an org member; CI and service tokens are not counted. Storage and bandwidth are fair use with no overage charge. Enterprise starts from $24,000 a year. https://chain305.com/changelog/#2026-09-29-signed-apt-and-yum-dnf-indexes-with-keys-in-your-kms https://chain305.com/changelog/#2026-09-29-signed-apt-and-yum-dnf-indexes-with-keys-in-your-kms Tue, 29 Sep 2026 12:00:00 GMT Added Hosted apt and yum/dnf repositories can now serve signed indexes, verified with apt-get update and dnf makecache. On the enterprise build, the signing key and the attestation key can live in AWS, Google Cloud or Azure KMS or in HashiCorp Vault, and never leave it. Vault was tested end to end; the three cloud providers are unit-tested. Signing fails closed: no signature, no index. https://chain305.com/changelog/#2026-09-13-siem-delivery-to-elastic-and-opensearch https://chain305.com/changelog/#2026-09-13-siem-delivery-to-elastic-and-opensearch Sun, 13 Sep 2026 12:00:00 GMT Added A fourth SIEM provider delivers Chainsaw events to the Elasticsearch or OpenSearch bulk API, with either an API key or basic auth. CEF deliveries for Sentinel and QRadar are now framed as RFC 5424 syslog, and a destination URL with credentials embedded in it is refused. https://chain305.com/changelog/#2026-09-11-signed-verification-attestations-for-passed-artifacts https://chain305.com/changelog/#2026-09-11-signed-verification-attestations-for-passed-artifacts Fri, 11 Sep 2026 12:00:00 GMT Added Chainsaw can mint a signed SLSA Verification Summary Attestation for an artifact it passed, so an admission controller such as sigstore's policy-controller can refuse anything that carries no such record. It is off by default and signs with the operator's key. https://chain305.com/changelog/#2026-09-07-orgs-can-require-mfa https://chain305.com/changelog/#2026-09-07-orgs-can-require-mfa Mon, 07 Sep 2026 12:00:00 GMT Added An org admin can now require multi-factor authentication for every member. Turning it on is refused unless the admin is enrolled. A new chainsaw policy show command prints a policy's full configuration, conditions included. https://chain305.com/changelog/#2026-08-25-the-guard-action-s-block-mode-now-blocks https://chain305.com/changelog/#2026-08-25-the-guard-action-s-block-mode-now-blocks Tue, 25 Aug 2026 12:00:00 GMT Fixed Every finding pr-scan emitted was a warning, so the GitHub Action in mode: block left a comment on the pull request and never failed it. pr-scan findings now go through the policy rules, so a rule can block on a chosen finding while new dependencies stay at warn. https://chain305.com/changelog/#2026-08-20-made-up-version-pins-caught-on-seven-more-ecosystems https://chain305.com/changelog/#2026-08-20-made-up-version-pins-caught-on-seven-more-ecosystems Thu, 20 Aug 2026 12:00:00 GMT Added A version that does not exist on its registry, the kind an AI coding tool can invent, is no longer scored as if it were real. v0.21.0 caught this on four ecosystems; PyPI, Maven, Cargo, RubyGems, NuGet, Go and Docker now follow. When the registry cannot say whether the package exists, the old behaviour stays. https://chain305.com/changelog/#2026-08-12-optional-fail-closed-coverage-gate-on-the-proxy https://chain305.com/changelog/#2026-08-12-optional-fail-closed-coverage-gate-on-the-proxy Wed, 12 Aug 2026 12:00:00 GMT Added Operators can name the data sources a verdict must have, and the proxy refuses a package when one of them could not be evaluated, instead of letting it through. The refusal says Chainsaw could not finish looking, not that it found something wrong, and a policy allow cannot override it. The gate is off by default; with it unset, nothing changes. https://chain305.com/comparison/ https://chain305.com/comparison/ Wed, 08 Jul 2026 12:00:00 GMT The four common ways teams keep a bad package out of a build — conceded fairly — and where Chainsaw sits behind them. Written to survive a skeptical reader. https://chain305.com/changelog/#2026-07-07-ai-model-scanning-reads-inside-zip-container-checkpoints https://chain305.com/changelog/#2026-07-07-ai-model-scanning-reads-inside-zip-container-checkpoints Tue, 07 Jul 2026 12:00:00 GMT Security PyTorch has saved .pt/.bin as a zip archive since 2020, with the pickle nested at archive/data.pkl — the format ~99% of Hugging Face models ship in. Chainsaw now unwraps the container before the pickle scan, so a malicious os.system buried inside a real checkpoint is caught, not just hand-crafted raw .pkl files. The opcode walker also models the pickle stack and memo, closing STACK_GLOBAL and byte-encoded-module evasions that dodge a naive text scan. https://chain305.com/changelog/#2026-06-26-one-command-guard-setup-plus-an-honest-first-run-and-doctor https://chain305.com/changelog/#2026-06-26-one-command-guard-setup-plus-an-honest-first-run-and-doctor Fri, 26 Jun 2026 12:00:00 GMT Changed chainsaw guard init --install writes the guard hook into your shell rc in one command — no copy-paste. guard update now shows live download progress so a slow dataset pull doesn't read as a hang. The first-run telemetry prompt defaults to yes with a plain-language disclaimer of exactly what's shared, and stays silent in CI. doctor's manager table is realigned and now reports a 'shim' state, so a manager protected by the shell guard no longer reads as unprotected. https://chain305.com/vs-jfrog-xray/ https://chain305.com/vs-jfrog-xray/ Tue, 26 May 2026 12:00:00 GMT Xray inspects what is already cached. Chainsaw refuses before the cache. Run both for 90 days, then retire Xray's policy surface. Artifactory storage stays. https://chain305.com/changelog/#2026-05-24-linux-distro-cve-detection-alpine-debian-red-hat-oracle-linu https://chain305.com/changelog/#2026-05-24-linux-distro-cve-detection-alpine-debian-red-hat-oracle-linu Sun, 24 May 2026 12:00:00 GMT Added Native CVE detectors per distro, with each stream updating on its own cadence — distinct from upstream OSV. A vendor advisory becomes a block-list entry the same hour the distro publishes it. Modular ingest means an Alpine stall doesn't hold up Red Hat coverage. https://chain305.com/changelog/#2026-05-22-bundled-hugging-face-malware-feed https://chain305.com/changelog/#2026-05-22-bundled-hugging-face-malware-feed Fri, 22 May 2026 12:00:00 GMT Added Native HF coordinate-match feed shipped in-process — closes the gap where public SCA indexes lag on model-repo malware. Lookup is constant-time at resolve; a hit drops trust score to -100. https://chain305.com/changelog/#2026-05-21-chainsaw-doctor-verify-hook-and-doctor-logs https://chain305.com/changelog/#2026-05-21-chainsaw-doctor-verify-hook-and-doctor-logs Thu, 21 May 2026 12:00:00 GMT Added Two new CLI subcommands. verify-hook detects client-side install-hook bypasses — a developer skipping the proxy via .npmrc edits or env overrides now shows up in doctor output. doctor logs surfaces operator-actionable WARN lines from the server so on-call doesn't have to grep raw stdout. https://chain305.com/changelog/#2026-05-20-docker-oci-inspector-and-swift-git-fallback-on-by-default https://chain305.com/changelog/#2026-05-20-docker-oci-inspector-and-swift-git-fallback-on-by-default Wed, 20 May 2026 12:00:00 GMT Changed Per-layer image inspection and Swift's git-tag fallback no longer need an opt-in flag. New deployments get container depth and Swift coverage out of the box. Existing installs keep their explicit config; the default only changes when the flag is unset. https://chain305.com/changelog/#2026-05-15-silent-success-write-telemetry-sql-tripwire https://chain305.com/changelog/#2026-05-15-silent-success-write-telemetry-sql-tripwire Fri, 15 May 2026 12:00:00 GMT Added published_to_inventory counters, drop counters, and a SQL tripwire fire when a write looks like it succeeded but didn't land. Six operator log lines were promoted DEBUG→WARN so the cases that used to need code-reading now show up in doctor logs. https://chain305.com/changelog/#2026-05-10-vex-aware-exception-cli https://chain305.com/changelog/#2026-05-10-vex-aware-exception-cli Sun, 10 May 2026 12:00:00 GMT Added chainsaw exception create now accepts --cve, --decision, and --vex-note. Exceptions carry VEX semantics — not_affected, affected, fixed, under_investigation — so the audit log answers vendor questionnaires directly. https://chain305.com/changelog/#2026-05-05-chainsaw-cargo-credentials-credential-provider-for-cargo-1-7 https://chain305.com/changelog/#2026-05-05-chainsaw-cargo-credentials-credential-provider-for-cargo-1-7 Tue, 05 May 2026 12:00:00 GMT Added Cargo's native credential-provider protocol now has a first-class Chainsaw integration. No more .cargo/config.toml token-in-plaintext patterns; the provider sources credentials from the OS keyring. https://chain305.com/vs-sca/ https://chain305.com/vs-sca/ Fri, 24 Apr 2026 12:00:00 GMT SCA tools report on exposure after the fact. Chainsaw is a control point that refuses non-compliant packages before they are consumed. Run both. https://chain305.com/vs-artifact-managers/ https://chain305.com/vs-artifact-managers/ Fri, 24 Apr 2026 12:00:00 GMT Artifact managers host your packages. Chainsaw decides what gets installed. Different layer, different problem. Keep your registry, add the policy layer. https://chain305.com/changelog/#2026-04-18-supply-chain-attack-signals-catalogue https://chain305.com/changelog/#2026-04-18-supply-chain-attack-signals-catalogue Sat, 18 Apr 2026 12:00:00 GMT Added Install-script exfiltration, maintainer takeover, version anomalies, hidden Unicode, publish-velocity bursts, reserved-namespace dependency confusion, Docker malware feed, per-layer image enforcement, APT/Yum/DNF hash-chain provenance, typosquat across 15 ecosystems including Go, CocoaPods, and GitHub Actions, repo liveness plus ownership match, and checksum fail-closed enforcement — 25 signals total, composable in a single policy. Four run on every ecosystem (CVE, license, reserved namespaces, trust score); the rest light up where each registry exposes the metadata we need. See our per-ecosystem coverage matrix for the full grid. https://chain305.com/changelog/#2026-04-18-browser-based-cli-login-with-turnstile https://chain305.com/changelog/#2026-04-18-browser-based-cli-login-with-turnstile Sat, 18 Apr 2026 12:00:00 GMT Added chainsaw auth login now opens a browser to the dashboard and uses a device-code flow with Cloudflare Turnstile to block automated login attempts. Works on headless shells via a short code; works on desktop via redirect. Tokens land in the OS keyring — macOS Keychain, Windows Credential Manager, Linux secret-service. https://chain305.com/changelog/#2026-04-18-cross-platform-cli-binaries https://chain305.com/changelog/#2026-04-18-cross-platform-cli-binaries Sat, 18 Apr 2026 12:00:00 GMT Added Builds for macOS (Intel and Apple Silicon), Linux (x86_64, arm64), and Windows (x86_64), each with a published SHA-256 checksum for download verification. The server URL can be baked into the binary at build time for air-gapped shipping. Sigstore-signed releases follow once the release-signer bot is provisioned. https://chain305.com/changelog/#2026-04-18-strict-jwt-mode-is-now-default https://chain305.com/changelog/#2026-04-18-strict-jwt-mode-is-now-default Sat, 18 Apr 2026 12:00:00 GMT Changed Chainsaw refuses to boot without CHAINSAW_JWT_SECRET or a persistent store to hold a generated secret. Multi-replica deployments are safer out of the box. Single-process dev still works with CHAINSAW_STRICT_JWT=0. https://chain305.com/changelog/#2026-04-18-force-https-scheme-upgrade-for-cli-auth https://chain305.com/changelog/#2026-04-18-force-https-scheme-upgrade-for-cli-auth Sat, 18 Apr 2026 12:00:00 GMT Fixed The CLI login URL now honours FORCE_HTTPS. Reverse-proxied Chainsaw deployments with TLS termination upstream no longer emit http:// redirects. https://chain305.com/changelog/#2026-04-18-web-ui-urls-resolved-via-next-app-basepath https://chain305.com/changelog/#2026-04-18-web-ui-urls-resolved-via-next-app-basepath Sat, 18 Apr 2026 12:00:00 GMT Fixed Dashboard URLs printed by the CLI during auth now respect NEXT_APP_BASEPATH and CHAINSAW_WEB_UI_URL, so Chainsaw deployments on a subpath or a custom domain get correct browser links.