The base file contains 76,510 blocked domains
The September 23, 2026 base file contains 76,510 entries drawn from maintained adware and malware sources. StevenBlack/hosts merges those inputs, removes duplicates, and maps the resulting domains to 0.0.0.0. A browser or app asking the operating system for one of those hostnames gets the non-routable address before normal DNS resolution. That makes the finished file useful without a background service, account, or browser extension. It also means blocking happens by hostname, not by page, request type, or user.
The repository publishes 31 variants in addition to the base list. Extensions cover fake news, gambling, pornography, and social media, either alone or mixed with the unified list. This is a better design than one giant maximum-blocking file because a family machine and a development workstation rarely need the same policy. Read the variant name carefully: an only list contains the chosen extensions without the base adware and malware collection.
An 85 MB clone is optional for ordinary use
Our checkout occupied 85 MB before installation, but people who only want blocking can download a raw generated file. The README warns that full history goes back to 2018 and recommends a shallow clone for anyone who needs the repository. That is sound advice here. Cloning, installing npm packages, and running Python are generator concerns. Copying the base file into a compatible hosts-file manager requires none of them.
Customization is the reason to take the longer path. The Python generator accepts additional data sources, four category extensions, a local blacklist, a local myhosts file, and a whitelist. Those local files are not tracked by Git, so an upstream pull should not overwrite them. One detail deserves care: whitelist entries use partial matching. Allowing google-analytics.com, for example, also excludes its subdomains from the generated blocklist.
What happened when we ran it
Our sandbox installed 150 npm packages in 14 seconds and used 37 MB on disk. The checkout at commit dcf08b8 contained 313 files and roughly 4,513 lines of source. There was no build script or target, so we skipped that step. The npm audit reported 0 known vulnerabilities across the installed packages. Those numbers describe our 3-CPU, 8 GB Debian container and the measured commit, not every installation method.
The test command failed with exit code 1 after 1 second. It launched python3 testUpdateHostsFile.py, which stopped on line 20 with ModuleNotFoundError: No module named 'requests'. The log does not show any test cases running, so there is no pass count to report. It establishes one narrower fact: the npm install completed, but the Python test environment in our fresh container did not have the module that the test imported.
That split is visible in the repository. package.json uses npm for release tooling and forwards npm test to Python, while requirements.txt separately lists requests and flake8. Our scan found 4 CI workflow files and a Dockerfile, but no tests directory; the test program sits at the repository root. The project documents pip3 install --user -r requirements.txt for its Python path, a step that matters even when npm itself reports a clean install.
Replacing a 76,510-entry hosts file needs system-level care
The documented Docker command mounts /etc/hosts and passes --replace, so it can modify a machine-wide networking file. The generator leaves the active file alone unless that flag is present, and it has a separate backup option. After replacement, the operating system or browser may retain earlier DNS answers, which is why the README gives cache-flush commands for Windows, Linux, and macOS. Automation should preserve the custom files and take a backup before a scheduled update.
Windows needs more judgment than the raw download suggests. The README says large hosts files can cause problems with the DNS Cache service, recommends compressed output, and warns that disabling the service can affect WSL. Open issue 3248 adds one user report from Windows 11 Pro 25H2: DNS Cache processing took long enough to interrupt internet access despite a compressed file. Treat that report as one fleet-specific warning and trial the chosen variant on the actual Windows machines.
Release 3.16.116 removed a reported false positive
Issue 3249 reported that the base smadex.com domain blocked a corporate site along with its client dashboard and contact pages. The request asked to keep named advertising and tracking subdomains blocked while restoring the root and web subdomains. The issue closed on September 20, 2026, and release 3.16.116 says the base domain was removed. The quick correction is encouraging. It also shows the unavoidable cost of domain-list blocking: somebody must notice and report an overbroad entry.
Most content disputes belong with the upstream source that contributed the domain, according to the project’s issue guidance. A local whitelist is therefore more than a convenience for managed machines. It is the immediate recovery path while a source maintainer reviews a report and the aggregated file catches up. Because matching is partial, test every exception against both the service you need and the subdomains you still intend to block.
Release 3.16.116 arrived with same-day source updates
GitHub recorded the last push on September 23, 2026, followed by release 3.16.116 that day. The release included source refreshes, domain additions and removal, and dependency updates. The repository had 31,103 stars and 154 open issues and pull requests when fetched; that combined GitHub number is not a bug count. Recent closed domain reports and merged pull requests show work happening alongside the automated list refreshes.
StevenBlack/hosts is easiest to recommend as a maintained artifact. Its npm package handles release work. Download the smallest suitable variant, keep an explicit whitelist, and know how to restore the previous system file. Build it yourself when the four extensions and local source controls solve a real policy need. If each device should not carry that maintenance burden, use the list through a network-level blocker such as Pi-hole instead.