@anonympins/fingerprint 0.4.1 → 0.4.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (19) hide show
  1. package/CHANGELOG.md +34 -0
  2. package/README.md +66 -60
  3. package/package.json +1 -1
  4. package/src/js/fingerprint.js +4529 -4429
  5. package/src/js/pow.solver.js +531 -497
  6. package/src/js/problem-manager.js +614 -539
  7. package/src/js/tests/fingerprint.test.js +2351 -2319
  8. package/src/js/tests/pow.solver.test.js +233 -197
  9. package/src/js/tests/problem-manager.test.js +358 -322
  10. package/src/php/AutoTuner.php +197 -154
  11. package/src/php/FingerprintEngine.php +1018 -1006
  12. package/src/php/Optimization/FunctionRegistry.php +63 -62
  13. package/src/php/Optimization/OptimizationOperators.php +401 -304
  14. package/src/php/ProblemManager.php +287 -254
  15. package/src/php/Tests/FingerprintEngineTest.php +330 -299
  16. package/src/php/Tests/ProblemManagerTest.php +376 -296
  17. package/src/php/Tests/RequestUtilsTest.php +256 -253
  18. package/src/php/Tests/problems.config.json +8 -8
  19. package/src/php/Utils/RequestUtils.php +1189 -1169
package/CHANGELOG.md CHANGED
@@ -1,3 +1,37 @@
1
+ ## Version 0.4.3
2
+
3
+ ### 🔒 Rotation Score Hardening (Anti-Spoofing & No-JS Parity)
4
+ - **Server-Only Rotation Analysis**: Completely removed all client-side telemetry (`X-Device-Fingerprint`, canvas, gpu, hardware concurrency) from the `rotationScore` computation across all engines (Node.js, PHP, Python).
5
+ - **Zero-Trust Client Inputs**: Fixed a vulnerability where client-side fingerprint spoofing or the absence of JS headers on static/API requests could trick the engines into triggering false-positive rotation alerts. The stable part analysis now relies exclusively on server-side signatures (`ua`, `ja3`, `ja4`, `h2`, `tcp`).
6
+
7
+ ### 🐍 Python Engine Parity & uPoW
8
+ - **Useful Proof-of-Work (uPoW) in Python**: Fully implemented uPoW support in Python, bringing complete parity to task dispatching and solution integration with the Node.js and PHP versions.
9
+ - **Dry Run & Score Matching**: Added robust Dry Run mode and suspicion score calculations in the Python engine, allowing passive security evaluation without request interruption.
10
+
11
+ ### 🐘 PHP Engine Enhancements
12
+ - **PHP uPoW Coverage**: Greatly expanded test coverage for the PHP `ProblemManager` and useful work integrations, ensuring reliability under heavy workloads.
13
+
14
+ ### 🛡️ Challenge Routing & Better Re-challenge
15
+ - **Refined Challenge Router**: Restructured challenge routing and solution validation pipelines for direct, consistent handling of cryptographic results.
16
+ - **Smarter Re-challenging**: Improved re-challenge behavior across all engines. If an already cleared device's score spikes above the high threshold again, the existing clearance ticket is bypassed, instantly prompting a fresh security challenge.
17
+
18
+ ## Version 0.4.2 (Hotfix)
19
+
20
+ ### 🧬 Auto-Tuner Rework & Sanity Guardrails
21
+ - **Genetic Optimizer Guardrails**: Hardened the auto-tuning engine (JS & PHP) with strict guardrails, ensuring optimized configurations maintain proper threshold hierarchies (`low < medium < high < block`) and prevent weights from collapsing below safe minimum thresholds.
22
+ - **Inertial Parameter Sliding**: Implemented a smooth update algorithm (`applyInertialUpdate`) that applies changes progressively using an adaptive learning rate to prevent configuration spikes.
23
+ - **Traffic-Confidence Learning**: Auto-tuning transitions are now weighted dynamically based on high-confidence traffic signals, slowing adjustments down in noisy/unreliable traffic and accelerating them during verified attacks.
24
+
25
+ ### ⚙️ Non-Blocking Useful Work & Problem Inits
26
+ - **Event Loop Cooperation (`yieldToEventLoop`)**: Integrated asynchronous cooperativeness during large dataset generation (such as `generate:randomPoints` and `generate:randomAssets`) to yield control back to the runtime and avoid freezing web servers.
27
+ - **Path Resolution Fixes**: Standardized `problems.config.json` file-path resolution using reliable absolute directory joining (`resolve` / `dirname`), mitigating boot crashes across varying execution contexts.
28
+ - **Useful Work Corrections**: Fixed uPoW integration issues to guarantee proper solution ingestion and accurate server-side verification.
29
+
30
+ ### ⚡ WASM Client & Packaging
31
+ - **WASM Loader Enhancements**: Refined WebAssembly initialization and asset-delivery routes (`wasmPath` / `wasmFile`), optimizing fallbacks and improving asset-delivery reliability.
32
+
33
+ ---
34
+
1
35
  ## Version 0.4.1
2
36
 
3
37
  ### 🐍 Full Python Engine Support & Middlewares
package/README.md CHANGED
@@ -1,61 +1,67 @@
1
- # Fingerprint anti-bot protection
2
-
3
- NodeJS tests : [![Test NodeJS](https://img.shields.io/github/actions/workflow/status/anonympins/fingerprint/ci-nodejs.yml)](https://github.com/anonympins/fingerprint/actions/workflows/ci.yml) / PHP tests : [![PHP](https://img.shields.io/github/actions/workflow/status/anonympins/fingerprint/ci-php.yml)](https://github.com/anonympins/fingerprint/actions/workflows/ci-php.yml) / Python tests : [![PHP](https://img.shields.io/github/actions/workflow/status/anonympins/fingerprint/ci-php.yml)](https://github.com/anonympins/fingerprint/actions/workflows/ci-python.yml)
4
-
5
- [![Release](https://img.shields.io/github/v/release/anonympins/fingerprint)](https://github.com/anonympins/fingerprint/releases)
6
- [![License](https://img.shields.io/github/license/anonympins/fingerprint)](https://github.com/anonympins/fingerprint/blob/main/LICENSE)
7
- ![GitHub commit activity](https://img.shields.io/github/commit-activity/w/anonympins/fingerprint)
8
-
9
- A multi-layered behavioral, cryptographic, and network analysis engine designed to identify and mitigate malicious requests (bots, scrapers, session hijacking) in real-time. Supports both **Node.js** and **PHP** environments.
10
-
11
- ![illustration](https://i.ibb.co/fV1QT6Mf/image-c6e10859baae53bb595112ec08fc9e27.png)
12
-
13
- ## Key Features
14
-
15
- - **Multi-Layered Detection**: Combines TLS/JA3/JA4 analysis, HTTP header consistency checks, IP reputation, and behavioral tracking (mouse movements, keystrokes).
16
- - **Adaptive Mitigation**: Imposes progressive cryptographic Proof-of-Work (PoW) challenges to block automated clients without impacting legitimate human users.
17
- - **Predefined Profiles**: Ready-to-use security profiles (`balanced`, `strict`, `api`, `blog`, `ecommerce`) tailored to your specific use case.
18
-
19
- ## Quick Start
20
-
21
- ### Node.js
22
-
23
- ```bash
24
- npm install @anonympins/fingerprint
25
- ```
26
-
27
- ### PHP
28
-
29
- ```bash
30
- composer require anonympins/fingerprint
31
- ```
32
-
33
- ## Documentation
34
-
35
- To prevent documentation drift, all detailed guides and reference materials are maintained in the `doc/` directory. Please refer to [these resources](https://github.com/anonympins/fingerprint/wiki/home) to configure and integrate the engine:
36
-
37
- 1. **[Key Concepts & Suspicion Vectors](https://github.com/anonympins/fingerprint/wiki/concepts)**: Learn how the engine calculates suspicion scores across the 15 distinct vectors and manages the Proof-of-Work mitigation layers.
38
- 2. **[Node.js Integration Guide](https://github.com/anonympins/fingerprint/wiki/nodejs_integration)**: Step-by-step instructions for Express.js middleware and raw HTTP server integrations.
39
- 3. **[PHP Integration Guide](https://github.com/anonympins/fingerprint/wiki/php_integration)**: Configuration details for direct PHP integration, TLS fingerprinting forwarding via Nginx/Apache, and securing Prometheus metrics.
40
- 4. **[Full Configuration Options](https://github.com/anonympins/fingerprint/wiki/full_options)**: Complete parameter list for fine-tuning weights, custom honeypots, and security profile overrides.
41
- 5. **[API Reference](https://github.com/anonympins/fingerprint/wiki/api_reference)**: Public API signatures and guides on substituting the in-memory datastore with Redis or MongoDB.
42
-
43
- Start with the **[Documentation Portal](https://github.com/anonympins/fingerprint/wiki/home)** for a complete index.
44
-
45
- ## Contributing
46
-
47
- We welcome community contributions! Please read our **[Contributing Guidelines](https://github.com/anonympins/fingerprint/blob/main/CONTRIBUTING.md)** for information on:
48
- - Setting up your local environment (Node.js and PHP).
49
- - Running the test suites (`Vitest` and `PHPUnit`).
50
- - Coding and pull request standards.
51
-
52
- Thanks to our contributors :
53
- - [anonympins](https://github.com/anonympins)
54
-
55
- ## Used actively on
56
-
57
- - https://primals.net and sub-sites
58
-
59
- ## License
60
-
1
+ # Fingerprint anti-bot protection
2
+
3
+ NodeJS tests : [![Test NodeJS](https://img.shields.io/github/actions/workflow/status/anonympins/fingerprint/ci-nodejs.yml)](https://github.com/anonympins/fingerprint/actions/workflows/ci.yml) / PHP tests : [![PHP](https://img.shields.io/github/actions/workflow/status/anonympins/fingerprint/ci-php.yml)](https://github.com/anonympins/fingerprint/actions/workflows/ci-php.yml) / Python tests : [![PHP](https://img.shields.io/github/actions/workflow/status/anonympins/fingerprint/ci-php.yml)](https://github.com/anonympins/fingerprint/actions/workflows/ci-python.yml)
4
+
5
+ [![Release](https://img.shields.io/github/v/release/anonympins/fingerprint)](https://github.com/anonympins/fingerprint/releases)
6
+ [![License](https://img.shields.io/github/license/anonympins/fingerprint)](https://github.com/anonympins/fingerprint/blob/main/LICENSE)
7
+ ![GitHub commit activity](https://img.shields.io/github/commit-activity/w/anonympins/fingerprint)
8
+
9
+ A multi-layered behavioral, cryptographic, and network analysis engine designed to identify and mitigate malicious requests (bots, scrapers, session hijacking) in real-time. Supports both **Node.js** and **PHP** environments.
10
+
11
+ ![illustration](https://i.ibb.co/fV1QT6Mf/image-c6e10859baae53bb595112ec08fc9e27.png)
12
+
13
+ ## Key Features
14
+
15
+ - **Multi-Layered Detection**: Combines TLS/JA3/JA4 analysis, HTTP header consistency checks, IP reputation, and behavioral tracking (mouse movements, keystrokes).
16
+ - **Adaptive Mitigation**: Imposes progressive cryptographic Proof-of-Work (PoW) challenges to block automated clients without impacting legitimate human users.
17
+ - **Predefined Profiles**: Ready-to-use security profiles (`balanced`, `strict`, `api`, `blog`, `ecommerce`) tailored to your specific use case.
18
+
19
+ ## Quick Start
20
+
21
+ ### Node.js
22
+
23
+ ```bash
24
+ npm install @anonympins/fingerprint
25
+ ```
26
+
27
+ ### PHP
28
+
29
+ ```bash
30
+ composer require anonympins/fingerprint
31
+ ```
32
+
33
+ ### Python
34
+ ```bash
35
+ pip install fingerprint-engine
36
+ ```
37
+
38
+ ## Documentation
39
+
40
+ To prevent documentation drift, all detailed guides and reference materials are maintained in the `doc/` directory. Please refer to [these resources](https://github.com/anonympins/fingerprint/wiki/home) to configure and integrate the engine:
41
+
42
+ 1. **[Key Concepts & Suspicion Vectors](https://github.com/anonympins/fingerprint/wiki/concepts)**: Learn how the engine calculates suspicion scores across the 15 distinct vectors and manages the Proof-of-Work mitigation layers.
43
+ 2. **[Node.js Integration Guide](https://github.com/anonympins/fingerprint/wiki/nodejs_integration)**: Step-by-step instructions for Express.js middleware and raw HTTP server integrations.
44
+ 3. **[PHP Integration Guide](https://github.com/anonympins/fingerprint/wiki/php_integration)**: Configuration details for direct PHP integration, TLS fingerprinting forwarding via Nginx/Apache, and securing Prometheus metrics.
45
+ 3. **[Python Integration Guide](https://github.com/anonympins/fingerprint/wiki/python_integration)**: Python middleware for ASGI and WSGI integration.
46
+ 4. **[Full Configuration Options](https://github.com/anonympins/fingerprint/wiki/full_options)**: Complete parameter list for fine-tuning weights, custom honeypots, and security profile overrides.
47
+ 5. **[API Reference](https://github.com/anonympins/fingerprint/wiki/api_reference)**: Public API signatures and guides on substituting the in-memory datastore with Redis or MongoDB.
48
+
49
+ Start with the **[Documentation Portal](https://github.com/anonympins/fingerprint/wiki/home)** for a complete index.
50
+
51
+ ## Contributing
52
+
53
+ We welcome community contributions! Please read our **[Contributing Guidelines](https://github.com/anonympins/fingerprint/blob/main/CONTRIBUTING.md)** for information on:
54
+ - Setting up your local environment (Node.js and PHP).
55
+ - Running the test suites (`Vitest` and `PHPUnit`).
56
+ - Coding and pull request standards.
57
+
58
+ Thanks to our contributors :
59
+ - [anonympins](https://github.com/anonympins)
60
+
61
+ ## Used actively on
62
+
63
+ - https://primals.net and sub-sites
64
+
65
+ ## License
66
+
61
67
  This project is licensed under the MIT License.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@anonympins/fingerprint",
3
- "version": "0.4.1",
3
+ "version": "0.4.3",
4
4
  "description": "Advanced anti-bot library for Node.js using multi-layer fingerprinting (JA3, client-side, headers), behavioral analysis, and adaptive Proof-of-Work (PoW) challenges to mitigate scraping, scalping, and automated threats.",
5
5
  "main": "index.js",
6
6
  "type": "module",