malware-hashes.json

{
  "version": 1,
  "note": "Local, KEYLESS known-malware SHA-256 set for Download Guard URL-content fingerprints. Chrome extensions cannot read arbitrary saved download files, so WardenOne re-fetches the download URL for REVIEWED web downloads (grade C and worse), hashes that response locally, and checks it against this set. Treat a match as critical (grade F), but do not treat a miss as proof the saved file is clean because signed, authenticated, one-time, blob, or personalized downloads can differ from the re-fetched response. The seed contains the EICAR anti-malware test file so the URL-content hash path can be verified end-to-end (download eicar.com -> blocked + removed). Extend this set by editing the array below, or feed it at runtime by writing an array/object to chrome.storage.local key 'wardenone_malware_hashes' (the two sources are merged on load and on change).",
  "sha256": [
    "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"
  ]
}