For an unknown binary, compute its hash, read its embedded metadata, search the repository history for who added it, and look for a build recipe. If it still cannot be identified, record it as unidentified, and plan to rebuild or replace it from source.
Why unknown binaries matter
A binary with no source is code nobody reviewed. It also cannot be matched to vulnerability data, because matching needs a name and version. The OpenSSF Scorecard Binary-Artifacts check exists for this reason: it flags generated executables in source repositories, and describes them as non reviewable code.
The identification ladder
Work down the steps until one answers.
| Step | Action | What it can tell you |
|---|---|---|
| 1 | Compute a cryptographic hash | A fingerprint to compare with known versions |
| 2 | Read file metadata and embedded version strings | Name, version, vendor |
| 3 | Check the commit that added it | Author, message, date, reason |
| 4 | Look for a script that downloads or builds it | Source of truth |
| 5 | Ask the owner | Context nobody wrote down |
| 6 | Compare the hash with the project's published releases | Exact match or modified |
The NTIA report notes that a cryptographic hash can help map components to data sources and help in cases of renaming, and that the consumer can compare the hash with a known trusted version.
If it matches a published release
Record the upstream project, version and hash. Then it joins the normal inventory and vulnerability flow.
If it does not match
It is modified, custom built or from a source you cannot find. Treat it as a fork: record it, find the closest upstream and decide whether to rebuild.
If nothing works
Mark it unidentified in the gap register with the hash, path, and owner. Decide:
- Remove it if it is unused.
- Rebuild from source with a recorded recipe.
- Replace with a package from a registry.
- Isolate and accept, with a named approver and a review date.
Typical examples
Old command line tools committed for a script, a vendor driver, test fixtures that became production dependencies, and compiled helper libraries from a developer who has left.
Preventing repeats
Ban committed binaries without a note, or require a build recipe in the pull request. A pull request gate can flag new binary files.
Safeguard offers SBOM and dependency scanning, asset discovery and compliance and evidence automation, and you can run a free scan at gold.safeguard.sh/scan.
Quick check
Is an unknown binary always dangerous?
No, but it is unreviewed and unmatched. That is a gap even if the file is harmless.
Sources
Last reviewed: 19 October 2026.
