Changelog

All notable changes to CryptoAnnihilator. Semantic Versioning.

v2.1.1 PATCH

2026-06-05

Security: SHA256 verification for --install-network — plugin downloads now verified against /version endpoint hash before install. Rejects tampered downloads.
Fix: Layer 4 detection — fixed cpu_usage dict unpacking and Detection() constructor parameter mismatch that caused silent failures.
Fix: Python 3.6+ compatibility — removed PEP 701 nested f-string quotes that broke on Python <3.12.
Added MIT LICENSE file to repository.
Added unit tests — 13 tests covering classify_wallet() and detect_layer3_known_names().
Version endpoint now includes plugin SHA256 hashes in plugins field.
Adventure Mode URL params — ?adventure=true or ?mode=adventure for direct deep links.

2026-06-05

Auto-update plugin (scannersend_update.py): Now stable and available. Install with --install-updater. Verifies SHA256 before applying any update. Zero telemetry.
About page: Added origin story and Community Immunity section.
Rogues Gallery: Public hall of shame at /rogues — IPs banned by the immune system.
Threat Feed API: /feed/stats (public) and /feed/blocklist (key-gated) on net.scannersend.org.
Minor copy updates and nav improvements.

2026-05-22

Layer 5: Wallet Forensics — extracts wallet addresses from /proc/PID/cmdline, /proc/PID/environ, and config files before killing
Plugin architecture — optional plugins loaded from /usr/local/bin/. Plugins are independent; none requires another.
ScannerSend Network plugin (scannersend_network.py v1.1) — opt-in wallet reporting to net.scannersend.org
Two-tier consent model: Tier 1 (anonymous reporting), Tier 2 (contribution tracking with receipts via --network-track)
Receipt system — every report returns a receipt ID; check status via python3 scannersend_network.py --check <id>
New CLI flags: --install-network, --no-network, --network-track, --persist
Enhanced opt-in prompt when wallet found but plugin not installed
SHA256 checksum verification

Base tool (crypto_annihilator.py): 1,618 lines. Never phones home. All detection + kill logic.
Plugin 1 (scannersend_network.py): Wallet reporting. Optional. Independent.
Plugin 2 (scannersend_update.py): Auto-updates. Optional. Independent. Coming soon.
Each plugin is a separate download with its own consent gate. No plugin requires another.

net.scannersend.org — separate container for report intake, HMAC-signed, rate-limited
/wallets public dashboard with 3+ IP confirmation threshold
/receipt/<id> and /contributions/<hash> API endpoints

“Leave no trace” wording updated: “The tool never phones home — unless you tell it to.”
Line count now dynamic (reads actual file at startup)
All site pages updated with consent model, root requirements, miner warning

2026-05-21

Layer 1: Network Protocol Detection (Stratum mining.subscribe/submit/authorize)
Layer 2: CPU Behavioral Analysis (sustained high CPU + suspicious connections)
Layer 3: Binary Signature Matching (known miner process names)
Layer 4: Connection Fingerprinting (mining pool port patterns)
--kill flag for process termination (scan-only by default)
--daemon for continuous monitoring
--fortify for 5-layer self-healing persistence
--uninstall for clean removal
Zero dependencies (Python 3.6+ stdlib only)
MIT License