@anonympins/fingerprint 0.4.6 → 0.5.0

package/CHANGELOG.md

@@ -1,3 +1,24 @@
+## Version 0.5.0
+
+### ✨ New Features
+
+- **Zero-Knowledge Proofs (ZKP)**: Added cryptographically secure Schnorr Zero-Knowledge Proofs (`generateZkpProof` on client and `verifyZkpProof` on server) for device fingerprints, allowing zero-disclosure fingerprint validation and making session tickets completely tamper-proof.
+- **Optional Ed25519 Asymmetric Keys**: Implemented dynamic and optional Ed25519 asymmetric key binding with an automatic fallback to symmetric AES-256-CBC encryption.
+- **Cooperative Proof-of-Space (Coop PoSpace)**: Introduced decentralized, cooperative Proof-of-Space challenge routing within local subnets. Highly suspicious clients must coordinate with neighboring subnet peers to fetch and aggregate cryptographic blocks. This vastly increases the cost and complexity for distributed botnets trying to cycle residential proxy IPs, as they are forced to run and maintain real, synchronized, and cooperative peer nodes within the same local IP subnet to solve challenges.
+
+### 🚀 Improvements
+
+- **Enhanced Malicious Injection Detection**: Upgraded the WAF and input validation subsystem to recursively inspect deeply nested NoSQL/SQL structures, significantly improving protection against complex MongoDb/SQL injection vectors.
+- **Traffic Data Pruning**: Introduced automated traffic data pruning (`pruneTrafficData`) with time-based and size-based limiters to avoid memory leaks during long-running auto-tuning sessions.
+
+### 🐛 Bug Fixes
+
+- **CI/CD OpenSSL Compatibility**: Fixed test environment crashes on older systems or CI/CD pipelines where the `OPENSSL_KEYTYPE_ED25519` constant is undefined.
+- **Autoloader savePath Resolution**: Resolved file-system path resolution bugs when saving optimized configurations inside the auto-tuner.
+- **Repository Size Optimization**: Pruned obsolete resources and optimized package assets to significantly reduce overall repository footprint.
+
+---
+
 ## Version 0.4.6
 
 ### ✨ New Features

package/README.md

@@ -1,12 +1,17 @@
 # Fingerprint anti-bot protection
 
-NodeJS tests : [![Test NodeJS](https://img.shields.io/github/actions/workflow/status/anonympins/fingerprint/ci-nodejs.yml)](https://github.com/anonympins/fingerprint/actions/workflows/ci.yml) / PHP tests : [![PHP](https://img.shields.io/github/actions/workflow/status/anonympins/fingerprint/ci-php.yml)](https://github.com/anonympins/fingerprint/actions/workflows/ci-php.yml) / Python tests : [![PHP](https://img.shields.io/github/actions/workflow/status/anonympins/fingerprint/ci-php.yml)](https://github.com/anonympins/fingerprint/actions/workflows/ci-python.yml)
+NodeJS tests : [![https://github.com/anonympins/fingerprint/actions/workflows/ci-nodejs.yml](https://img.shields.io/github/actions/workflow/status/anonympins/fingerprint/ci-nodejs.yml)](https://github.com/anonympins/fingerprint/actions/workflows/ci-nodejs.yml) / PHP tests : [![https://github.com/anonympins/fingerprint/actions/workflows/ci-php.yml](https://img.shields.io/github/actions/workflow/status/anonympins/fingerprint/ci-php.yml)](https://github.com/anonympins/fingerprint/actions/workflows/ci-php.yml) / Python tests : [![https://github.com/anonympins/fingerprint/actions/workflows/ci-python.yml](https://img.shields.io/github/actions/workflow/status/anonympins/fingerprint/ci-php.yml)](https://github.com/anonympins/fingerprint/actions/workflows/ci-python.yml)
 
-[![Release](https://img.shields.io/github/v/release/anonympins/fingerprint)](https://github.com/anonympins/fingerprint/releases)
-[![License](https://img.shields.io/github/license/anonympins/fingerprint)](https://github.com/anonympins/fingerprint/blob/main/LICENSE)
-![GitHub commit activity](https://img.shields.io/github/commit-activity/w/anonympins/fingerprint)
+[![https://github.com/anonympins/fingerprint/releases/tag/fingerprint-0.5.0](https://img.shields.io/github/v/release/anonympins/fingerprint)](https://github.com/anonympins/fingerprint/releases)
+[![https://raw.githubusercontent.com/anonympins/fingerprint/refs/heads/main/LICENSE](https://img.shields.io/github/license/anonympins/fingerprint)](https://github.com/anonympins/fingerprint/blob/main/LICENSE)
+[![https://github.com/anonympins/fingerprint/commits/main](https://img.shields.io/github/commit-activity/w/anonympins/fingerprint)](https://github.com/anonympins/fingerprint/commits/main)
+[![https://github.com/anonympins/fingerprint](https://img.shields.io/github/repo-size/anonympins/fingerprint)](https://github.com/anonympins/fingerprint)
 
-A multi-layered behavioral, cryptographic, and network analysis engine designed to identify and mitigate malicious requests (bots, scrapers, session hijacking, bot farms) in real-time. Supports **Node.js**, **Python** and **PHP** environments.
+A multi-layered behavioral, cryptographic, and network analysis production-grade engine designed to identify and mitigate malicious requests (bots, scrapers, session hijacking, bot farms) in real-time. Supports **Node.js**, **Python** and **PHP** environments. 
+
+It leverages multi-layer hardware fingerprinting, real-time behavioral analysis, passive network/TLS tracking, and adaptive/useful proof-of-work challenges to dynamically detect and mitigate scraping, scalping, account takeover (ATO), and sophisticated automated threats.
+
+Supported officially on **Node.js (>=20.0.0)**, **PHP (>=8.0)**, and **Python (>=3.8)**.
 
 ![illustration](https://i.ibb.co/fV1QT6Mf/image-c6e10859baae53bb595112ec08fc9e27.png)
 
@@ -14,11 +19,42 @@ A multi-layered behavioral, cryptographic, and network analysis engine designed
 
 [![Presentation](https://i.ibb.co/1tkPS01C/Capture-d-cran-2026-09-07-194728.png)](https://www.youtube.com/watch?v=Ujeznl0JAl4)
 
-## Key Features
 
-- **Multi-Layered Detection**: Combines TLS/JA3/JA4 analysis, HTTP header consistency checks, IP reputation, and behavioral tracking (mouse movements, keystrokes).
-- **Adaptive Mitigation**: Imposes progressive cryptographic Proof-of-Work (PoW) challenges to block automated clients without impacting legitimate human users.
-- **Predefined Profiles**: Ready-to-use security profiles (`balanced`, `strict`, `api`, `blog`, `ecommerce`) tailored to your specific use case.
+## 🚀 Key Features
+
+### 1. 🧬 Polymorphic Client-Side WASM & JS Solvers
+* **Polymorphic WebAssembly Solver**: Dynamically generates unique, randomized C++ compiled WebAssembly binary modules per session. Prevents static analysis, bot automation, and emulator tampering.
+* **IndexedDB WASM Caching**: Transparently caches compiled WASM modules (`wasm-cache-db`) in the browser's IndexedDB, minimizing initialization overhead and execution lag on subsequent visits.
+* **Advanced Obfuscation**: Uses multi-layered control flow flattening and string array obfuscation for client-side libraries.
+
+### 2. 💱 Useful Proof-of-Work (uPoW) & PoSpace
+* **Collaborative Useful PoW**: Instead of burning CPU cycles on arbitrary mathematical hash puzzles, suspicious clients solve complex optimization problems (e.g., *Traveling Salesperson*, *Portfolio Allocation*, *Facility Location*, *Fraud Detection Parameter Tuning*).
+* **Proof-of-Space (PoSpace) Challenge**: Forces browser clients to allocate and verify access to massive, persistent storage chunks (e.g., 100MB) inside IndexedDB, multiplying the cost of multi-threaded headless automation.
+* **Chained CPU/Memory Challenges**: Employs client-side resource exhaustion techniques (Chained SHA-256 target seeking & Memory Hard allocation vectors up to 128MB) that are validated in $O(1)$ on the server.
+
+### 3. 🌐 Passive TLS, HTTP/2, and TCP/IP (p0f) Tracking
+* **Native JA3/JA4 TLS Handshake Parsing**: Inspects raw TLS client hello bytes to extract and analyze cipher suite arrangements, extensions, and elliptic curve formats.
+* **Passive TCP/IP Stack Fingerprinting**: Emulates `p0f` rules by analyzing raw TCP SYN packets (TTL, Window Size, MSS, WS, SACK) to classify client OS and detect raw network spoofing.
+* **Multi-Language Handshake Parser**: Built-in support for event-driven PHP runtimes (Swoole, ReactPHP, Workerman), Node.js native sockets, and Python ASGI/WSGI contexts.
+
+### 4. 🧠 Stateful Behavioral Entropy & Click Variance
+* **Click Coordinate Variance**: Tracks exact click relative positions on DOM elements to compute spatial entropy, flagging bots clicking targets with robotic, mathematically perfect precision (zero variance).
+* **Mobile Touch Move Dynamics**: Captures mobile-specific touchscreen signals, analyzing tactile contact area radius, variable pressure indices, and multi-touch capabilities.
+* **Typing Keystroke Latency**: Measures real-time keystroke interval latencies to prevent automated text insertion.
+
+### 5. 🔍 Cross-Layer & Analog Inconsistency Scoring
+* **Layer Cross-Referencing**: Analyzes inconsistencies between User-Agent declarations, Client-Hints (`Sec-CH-UA`), TLS Handshake capabilities, and TCP stacks (e.g., claiming Windows NT on Chrome but negotiating TLS like curl/Safari on a Linux kernel).
+* **Viewport Aspect ratio & Screen mismatches**: Detects virtualized viewports exceeding physical dimensions or fake hardware specifications.
+
+### 6. 🦠 Honeypot Traps & Extensible WAF
+* **Signed Trap URLs**: Injects visually hidden, signed trap URLs into the DOM. Attempts to crawl, probe, or scrape these URLs immediately condemn the device.
+* **Recursive Injection Filters**: Inspects deeply nested payload structures (JSON/NoSQL/GraphQL) using a robust regular expression matrix to flag SQLi, XSS, XXE, SSTI, and JNDI (Log4Shell) vulnerabilities.
+* **ModSecurity NodeJS Extensibility**: Allows plugging in native core rule sets or custom WAF rule compilers into the honeypot pipeline.
+
+### 🧬 Progressive Threshold Auto-Tuning
+* **Genetic Policy Optimizer**: Dynamically updates classification parameters using a multi-objective genetic algorithm on your actual sanitized traffic data.
+* **Inertial Parameter Sliding**: Adjusts security thresholds slowly with an adaptive learning rate to prevent configuration spikes.
+* **Sybil Protection**: Filters out traffic logs, ensuring individual compromised bot networks cannot pollute optimization datasets.
 
 ## Quick Start
 
@@ -62,9 +98,18 @@ We welcome community contributions! Please read our **[Contributing Guidelines](
 Thanks to our contributors : 
 - [anonympins](https://github.com/anonympins)
 
-## Used actively on
+## 💖 Sponsor This Project
+
+If this security suite helps protect your business against botnets, automated scraping, credential stuffing, or Layer 7 DDoS attacks, please consider supporting its active development!
+
+Sponsorship helps maintain the library, fund active updates, and keep the dynamic WebAssembly engine cutting-edge.
+
+### 🌟 Featured Sponsors
+
+<img src="https://s6.imgcdn.dev/YJTWv9.png" width="100" alt="YJTWv9.png" border="0" valign="middle"> 
+
+[https://primals.net](https://primals.net) and sub-sites
 
-- https://primals.net and sub-sites
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anonympins/fingerprint",
-  "version": "0.4.6",
+  "version": "0.5.0",
   "description": "Advanced anti-bot library for Node.js using multi-layer fingerprinting (JA3, client-side, headers), behavioral analysis, and adaptive Proof-of-Work (PoW) challenges to mitigate scraping, scalping, and automated threats.",
   "main": "index.js",
   "type": "module",
@@ -9,6 +9,7 @@
   },
   "scripts": {
     "test": "vitest run --reporter=verbose",
+    "pub": "npm run build && npm login && npm publish --access public",
     "build": "node src/js/build-client.js"
   },
   "exports": {

package/src/js/fingerprint.client.js

@@ -82,6 +82,56 @@ const ClientLibrary = {
      */
     _hasher: (str, seed) => activeCyrb53(str, seed),
 
+    /**
+     * Génère une preuve de connaissance à divulgation nulle (ZKP) de Schnorr pour l'empreinte de l'appareil.
+     * Rend le tout stable et compatible avec les vérifications JS, PHP et Python.
+     * @param {string} fingerprint - L'empreinte de l'appareil.
+     * @returns {Promise<string>} La preuve sous format "y:t:s" en hexadécimal.
+     */
+    async generateZkpProof(fingerprint) {
+        const ZKP_P = 115792089237316195423570985008687907853269984665640564039457584007908834671663n;
+        const ZKP_G = 2n;
+        const cryptoObj = window.crypto || window.msCrypto;
+
+        const sha256Hex = async (str) => {
+            const encoder = new TextEncoder();
+            const data = encoder.encode(str);
+            const hashBuffer = await cryptoObj.subtle.digest('SHA-256', data);
+            const hashArray = Array.from(new Uint8Array(hashBuffer));
+            return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
+        };
+
+        const modPow = (base, exponent, modulus) => {
+            if (modulus === 1n) return 0n;
+            let result = 1n;
+            base = base % modulus;
+            while (exponent > 0n) {
+                if (exponent % 2n === 1n) {
+                    result = (result * base) % modulus;
+                }
+                exponent = exponent >> 1n;
+                base = (base * base) % modulus;
+            }
+            return result;
+        };
+
+        const xHex = await sha256Hex(fingerprint);
+        const x = BigInt('0x' + xHex) % ZKP_P;
+        const y = modPow(ZKP_G, x, ZKP_P);
+        const randomBytes = new Uint8Array(32);
+        cryptoObj.getRandomValues(randomBytes);
+        let vHex = Array.from(randomBytes).map(b => b.toString(16).padStart(2, '0')).join('');
+        let v = BigInt('0x' + vHex) % (ZKP_P - 1n);
+        if (v === 0n) v = 1n;
+        const t = modPow(ZKP_G, v, ZKP_P);
+        const cStr = ZKP_G.toString() + y.toString() + t.toString();
+        const cHex = await sha256Hex(cStr);
+        const c = BigInt('0x' + cHex) % ZKP_P;
+        const s = (v + c * x) % (ZKP_P - 1n);
+
+        return `${y.toString(16)}:${t.toString(16)}:${s.toString(16)}`;
+    },
+
     /**
      * Génère l'empreinte de l'appareil actuel.
      */
@@ -290,6 +340,91 @@ const ClientLibrary = {
         document.addEventListener('touchend', handleTouch, { passive: true });
     },
 
+    /**
+     * Initialise l'espace Proof-of-Space persistant dans l'IndexedDB locale.
+     */
+    async initializeSpace(seed, sizeMb) {
+        return new Promise((resolve, reject) => {
+            const request = indexedDB.open('pospace-db', 1);
+            request.onupgradeneeded = (e) => {
+                const db = e.target.result;
+                if (!db.objectStoreNames.contains('blocks')) {
+                    db.createObjectStore('blocks');
+                }
+            };
+            request.onsuccess = async (e) => {
+                const db = e.target.result;
+                const tx = db.transaction('blocks', 'readwrite');
+                const store = tx.objectStore('blocks');
+                
+                const maxBlocks = sizeMb * 1024;
+                const countReq = store.count();
+                countReq.onsuccess = async () => {
+                    if (countReq.result < maxBlocks) {
+                        for (let i = 0; i < maxBlocks; i++) {
+                            const block = new Uint8Array(1024);
+                            let h = 5381;
+                            for (let j = 0; j < seed.length; j++) {
+                                h = (h << 5) + h + seed.charCodeAt(j);
+                            }
+                            h = (h << 5) + h + i;
+                            for (let k = 0; k < 1024; k++) {
+                                h = Math.imul(h ^ k, 1597334677);
+                                block[k] = h & 0xff;
+                            }
+                            store.put(block, i);
+                        }
+                    }
+                    resolve();
+                };
+            };
+            request.onerror = () => reject(new Error("Failed to open pospace database"));
+        });
+    },
+
+    /**
+     * Lit un bloc spécifique de l'IndexedDB locale sous format hexadécimal.
+     */
+    async readSpaceBlock(blockIdx) {
+        return new Promise((resolve, reject) => {
+            const request = indexedDB.open('pospace-db', 1);
+            request.onsuccess = (e) => {
+                const db = e.target.result;
+                const tx = db.transaction('blocks', 'readonly');
+                const store = tx.objectStore('blocks');
+                const getReq = store.get(blockIdx);
+                getReq.onsuccess = () => {
+                    const block = getReq.result;
+                    if (block) {
+                        const hex = Array.from(block).map(b => b.toString(16).padStart(2, '0')).join('');
+                        resolve(hex);
+                    } else {
+                        reject(new Error("Block not found"));
+                    }
+                };
+                getReq.onerror = () => reject(getReq.error);
+            };
+            request.onerror = () => reject(new Error("Failed to open pospace database"));
+        });
+    },
+
+    /**
+     * Résout le Proof-of-Space en combinant optionnellement le bloc du pair.
+     */
+    async solveSpaceChallenge(seed, queries, nonce, clientSecret, peerBlock = '') {
+        const blocks = [];
+        for (const idx of queries) {
+            const blockHex = await this.readSpaceBlock(idx);
+            blocks.push(blockHex);
+        }
+        let finalPayload = blocks.join('') + peerBlock + nonce + ":" + clientSecret;
+        const encoder = new TextEncoder();
+        const data = encoder.encode(finalPayload);
+        const hashBuffer = await window.crypto.subtle.digest('SHA-256', data);
+        const hashArray = Array.from(new Uint8Array(hashBuffer));
+        return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
+    },
+
     /**
      * Démarre le suivi des mouvements de la souris pour calculer l'entropie.
      * À appeler une fois sur la page.
@@ -842,6 +977,10 @@ export const initializeWasm = ClientLibrary.initializeWasm.bind(ClientLibrary);
 export const injectTrapLinks = ClientLibrary.injectTrapLinks.bind(ClientLibrary);
 export const injectPhantomTraps = ClientLibrary.injectPhantomTraps.bind(ClientLibrary);
 export const solveChallengeAndRetry = ClientLibrary.solveChallengeAndRetry.bind(ClientLibrary);
+export const generateZkpProof = ClientLibrary.generateZkpProof.bind(ClientLibrary);
+export const initializeSpace = ClientLibrary.initializeSpace.bind(ClientLibrary);
+export const readSpaceBlock = ClientLibrary.readSpaceBlock.bind(ClientLibrary);
+export const solveSpaceChallenge = ClientLibrary.solveSpaceChallenge.bind(ClientLibrary);
 
 // Export the internal object for testing purposes
 export default ClientLibrary;