Electron release diff for security review and audit: compare two builds (app.asar, .app, install directory, release ZIP) and see what changed in IPC, contextBridge, window settings, network hosts and storage, with file and line. CI check with SARIF, MCP s
Electron release diff for security review. hexvero compares two builds of an Electron app (an
app.asar, a .app, an install directory or a release ZIP) and reports what changed in IPC
channels, contextBridge members, window settings, network hosts and storage, with the file and
line on both sides, plus a release policy check for CI (text, JSON, Markdown, SARIF). It only reads
the files; nothing is executed. The same zero-dependency parsers also read ELF, PE, Mach-O, Go,
.NET, WebAssembly, EVM, SQLite, plist, APK, source maps and HAR. CLI, MCP server and web UI.
npx hexvero demo
npx hexvero compare old/YourApp.app new/YourApp.app --report report.html
npx hexvero init old/YourApp.app
npx hexvero check old/YourApp.app new/YourApp.app --policy .hexvero/policy.json
npx hexvero setup --apply
Documentation and source: https://github.com/maximilianfeix/hexvero
FAQs
Know what changed inside your Electron release. Electron release diff for security review: compare two builds (app.asar, .app, install directory, release ZIP) and see what changed in IPC, contextBridge, window settings, network hosts and storage, with fil
The npm package hexvero receives a total of 0 weekly downloads. As such, hexvero popularity was classified as not popular.
We found that hexvero demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Threat Research
/Security News
Socket uncovered secret-stealing workflows that ran in LiteLLM’s GitHub repository 11 days before the supply chain attack on PyPI and Docker.
Security News
Cloudflare introduces tsrs, a Rust port of TypeScript’s compiler promising faster checks and lower memory use, with the TypeScript team’s help.
Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.