Tool Statically Diffs Electron App Builds to Reveal Security-Relevant Changes

A developer built hexvero, a tool that compares two Electron app.asar bundles without running either build. It links preload-script bridge members to IPC handlers and reports window setting changes such as nodeIntegration and sandbox. Where channel names cannot be resolved statically, it flags them as unresolved rather than guessing or dropping them. The tool is read-only and produces a local web view and Markdown reports, but its findings describe code contents, not exploitability. On a blind test set it found only part of the IPC channels and version changes, and the author publishes those misses.