snare
snare v1.9.0 released — update restarts the guard, notifies or auto-installs
snare update now restarts the guard and cleans up after itself. And snare tells you when there's a new version, or installs it for you. No more snare guard stop && snare guard start After an update, the background guard used to keep running the old version until you restarted it
What to do: Update: `snare update`.
snare v1.8.0 released — a block explains what it caught
When snare blocks something, it now tells you exactly what it caught, and gives it to you in a form you can copy. What snare caught, up front A block now opens with each file and line snare suspects, why, and the text that matched. The whole message is also saved to ~/.snare/logs
What to do: Update: `snare update`.
snare v1.7.1 released — the 'behind' message goes away after you update
The "commit(s) behind" message now goes away after you update. snare remembers whether it's behind so it doesn't need to ask GitHub on every command. But it never updated that memory when you updated. Right after snare update succeeded, every command still said "1 commit(s) behin
What to do: Update: `snare update`.
snare v1.7.0 released — snare update now actually updates
snare update now actually updates. Some of you saw snare update answer "already up to date" every time while snare version said you were behind. Both were telling the truth about different branches. snare update pulled whatever branch your install was on, and snare version compar
What to do: Update: `snare update`.
snare v1.6.0 released — known-malicious packages in every ecosystem
snare now knows which package versions are malware, for npm, Python, Rust, Go and more, and stops them before they install. Supply-chain malware isn't only an npm problem anymore. This month, LiteLLM's release pipeline was hijacked, and version 1.107.0 on PyPI shipped a file that
What to do: Update: `snare update`.
snare v1.5.0 released — the gate: scan before code comes in or runs
snare now checks code before your coding agent pulls it in or runs it, and shows you what it found. The incident behind this release was ordinary work: a pull, an install, npm run dev. A coding agent did it in a repository that had been poisoned upstream, and nobody found out for
What to do: Update: `snare update`.
snare v1.4.3 released — a purge that reported zero and left the payload
Found by purging a real repository and then scanning what came back. A 29,057-byte api.js survived the rewrite, and the purge printed blobs still carrying a hidden payload: 0. The verify step re-runs the same cleaner, so anything the cleaner cannot see verifies clean — a false cl
What to do: Update: `snare update`.
snare v1.4.2 released — four false positives out, four real ways in
Found by running 1.4.1 against a real repository rather than a fixture. The false positive node\s+.*(-e|--eval) left the flag unanchored, so atlas-engine matched. An honest PostToolUse hook running packages/atlas-engine/hooks/atlas-tag.ts was reported as *"an agent hook runs a dr
What to do: Update: `snare update`.