Hash sets
SHA-256 hash sets shipped in the signed feed: known-bad hashes trigger a malicious verdict, allow sets mark verified WordPress core files as clean.
Shelltrap ships two kinds of hash data in every signed generation:
- Known-bad hashes (
hashes/*.hsb): exact SHA-256 matches of confirmed malware. A match produces a malicious verdict with confidence 100. - Allow sets (
allow/*.sha256): SHA-256 hashes of verified files, currently the WordPress core files of supported releases downloaded from wordpress.org and hashed by Panomity. A match suppresses heuristic signals for that file; signature and ClamAV hits still take precedence.
Hashes are data, not works; the allow sets are published under the MIT license by Panomity GmbH. False positives or missing versions: hallo@panomity.de .