X
Campaign documented
Xeno
A public GitHub repository and a Bitdefender report. The profile compares the loader the repository describes with the loader the fake installer replaced.
59%
1// what 59% means
2missing → script calls a function Solara does not have
3result → runtime error, not malware
4// what 59% does not mean
5not → "safe"
6not → "working"
7not → "undetected"
Sources: ScriptBunker Solara profile · ScriptBlox version log . A partial sUNC score is not a security audit.
What a partial sUNC score measures
sUNC tests whether an executor implements a specific list of standard functions. The suite runs each function as if a real script were calling it. A score of 59% means 59% of those tests passed. The remaining 41% failed or were not implemented .
When a script calls a missing function, it throws a runtime error. The script does not run. That is a compatibility problem, not a security problem. A script that needs a function Solara lacks will fail on Solara. It will not steal your cookies because the function is absent.
The distinction matters for how you read the score. A low sUNC score tells you which scripts will break. It does not tell you whether the executable is malicious. Those are separate questions, answered by separate tools.
What the version log actually proves
ScriptBlox records a long series of updates for Solara, going back over a year . Entries include "vuln patches," "fixed an execution breaking bug," "updated version" hashes, and "solara no longer requires admin to run." The log is detailed and dated.
A version log proves the project is active. It proves someone is pushing updates. It does not prove that the updates are safe, that the developer is identifiable, or that the binary delivered through the update mechanism matches the changelog.
The log is a record of activity. The sUNC score is a record of function coverage. The detection flag is a record of anti-cheat recognition. None of the three is a record of what the executable contains.
The record, with its gaps marked
| Attribute | Value | Source type | Confidence |
|---|---|---|---|
| Version | 0.1.7c | Third-party tracker | Recorded |
| sUNC | 59% | Third-party tracker | Recorded |
| UNC | 66% | Third-party tracker | Recorded |
| Detection | Detected | Third-party tracker | Recorded |
| Version log | 1+ year | Third-party tracker | Recorded |
| Official source | Not verified | — | Unknown |
| Sandbox score | Not found | — | Unknown |
"Recorded" means the tracker published the value. "Unknown" means no source was found at review time. Neither is a safety rating.
What this page does not claim
- This page does not claim Solara is malware. It records a partial function score and a detection flag from a third-party tracker.
- This page does not claim the 41% of missing functions are a security feature. A missing function is a compatibility failure, not a protection mechanism.
- This page does not claim the version log proves the current binary matches the changelog. A log is a record of updates, not a verification of the delivered file.
Solara questions, separated from the marketing
Does 59% sUNC mean Solara only works half the time?
No. It means 59% of the functions in the sUNC test suite are implemented and working. A script that uses only those functions will run. A script that calls one of the missing 41% will throw a runtime error. The score measures coverage, not reliability.
What does "Detected" mean for Solara?
ScriptBunker marks the build as Detected . That means the anti-cheat recognizes the executor. It is a game-security signal, not an antivirus verdict. ScriptBunker itself notes that "not marked detected" is not a guarantee of safety.
Why does the version log matter if it does not prove safety?
Because it proves activity. A project that pushes updates is a project someone is maintaining. That is useful context. It is not the same as a verified source, a clean binary, or a safety record. The log answers "is this active?" It does not answer "is this safe?"
Where is Solara's official source?
No developer-controlled source was verified at review time. Cloudflare Radar shows getsolara.dev/download/ with the title "Download Solara — Official Download for Windows" , but this page does not treat that link as verified. A page title is not a source audit.
Can I download Solara from this page?
Not yet. The Download button is a placeholder. When you have a confirmed source and choose to link it, replace the href. Until then, this page serves no file.
Why does this page look different from Xeno's?
Because the evidence is different. Xeno has a documented malware campaign and a public repository to compare. Solara has a partial function score and a long version log from trackers. The layout uses a narrow coverage panel instead of a two-panel comparison because the evidence is a single measurement with a long history, not two artifacts side by side.