Crowsnest 0.1.0 release notes.

These notes describe the code as it stands on 2026-10-07. There is no release date. This page will be updated when a GitHub release is tagged.

What is in it?

• Dashboard. Four pages: Horizon (what needs your attention), Lookout (who maintains your packages), Hold (what is installed) and Log (everything Crowsnest has called). Live updates, no login. See Using the dashboard.
• Command line. crowsnest scan, investigate, blast-radius, replay, watch, install and config. crowsnest install stops installs at risk 0.6 or above. See CLI usage.
• Slack bot. Posts the most serious calls to a channel and answers four commands. See Slack bot.
• VS Code extension. Margin warnings on imports in JavaScript, TypeScript and Python files. See VS Code extension.
• Plain calls. Every finding is a Clear, Watch or Hold with what happened and what to do.
• Self-hosted. Run it with Docker or from source. Every API key is optional. Apache-2.0.

How do I get it?

Follow the Quickstart. The command line tool and the VS Code extension are built from source. Neither is published: not on npm, not on the VS Code Marketplace.

What are the known limits?

• A scan on a fresh install with no API keys can fail in 0.1.0 (seen 2026-10-07). See Troubleshooting.
• The Docker image does not include the built-in lists of known harmful packages and known AI-invented names, so those checks do nothing there. From source they load.
• Only installs run as crowsnest install are checked; a plain npm install is not.
• The 0.6 install stop is fixed and cannot be changed.
• If Crowsnest cannot be reached, crowsnest install warns and installs anyway.
• A package Crowsnest has no data on adds 0.2 risk and still installs.
• npm projects get the most checks; coverage for other kinds of project is thinner.
• It does not replace tools that track known security bugs, such as Dependabot or Snyk.
• It cannot see an attack that has left no public trace yet.
• crowsnest scan --watch is listed but does not repeat the scan yet.
• The dashboard has no login. Keep it on your own machine or network.
• To scan a folder from the Docker setup, you must share that folder with the container.
• There is no hosted version.

What this does not do

These notes do not promise a date or a feature list for the next version. They also do not claim any fix beyond what the code does today. Check the repository for current state.

Found a rough edge? Open an issue on GitHub, and read Contributing. To learn what the safe-install check is for, read What is slopsquatting?.

Found a rough edge? Tell us. Version 0.1.0 expects them.