Atomdrift Scan v2.0.0 got the headline, but it doesn't run alone — here's the rest of the stack that shipped the same day.
cleave v2.0.0 is the big one: the engine swap is done. All parsing now lives in the filefacts crate, which means a breaking JSON schema v3 and a round of CLI renames. Output is now context-centric — context is the sole evidence surface, with grep-style hex windows, bold evidence, and Z85 compact encoding. Coverage grew in two directions: package archives (npm, crate, NuGet, APK, ASAR, CRX) and a wave of appliance and mainframe rules (FortiOS, PanOS, JunOS, Netscaler, Ivanti, RouterOS, JCL), plus surfaced Program Identity. Under the hood: an admission gate, a bounded regex cache that fixes a ~7.7 GB leak, SIMD matching, corrected Mach-O offsets, and archive XOR/payload recursion that catches split payloads. Release notes.
stng v1.6.2 kills a class of XOR false positives: the decoder now drops strings ≥16 chars where one byte is more than half the content, so repeated-byte runs stop XOR-ing into base64-looking junk. The dotted-pattern XOR scan went from up to 255 full-buffer passes to one — same output, much faster on large inputs. FormatHint::Binary is gone (use Auto), thiserror is dropped for anyhow, and ~764 lines of dead amd64 code went with it. Release notes.
filefacts v1.0.1 adds Program Identity extraction — publisher and package metadata pulled from CRX, npm, nupkg, Rust crate, wheel, and xpi archives. Binary parsing is now panic-safe: goblin is wrapped to fail soft on malformed PE/Mach-O/ELF instead of aborting the run. Add JCL detection, PKGBUILD classified as shell, corrected Mach-O FAT and PE offsets, and richer PE version/debug info. Release notes.
brew upgrade atomdrift/tap/cleave atomdrift/tap/stng atomdrift/tap/filefacts