@anonympins/fingerprint 0.7.2 → 0.7.4

package/CHANGELOG.md

@@ -1,21 +1,48 @@
+## Version 0.7.4
+
+- 🛡️ **Security & Rate Limiting**:
+  - **Domain-Aware Challenge Rate Limiter**: Implemented a new rate-limiting mechanism that operates on a per-domain basis. This enhances stability in multi-tenant architectures and mitigates challenge-based DoS attacks by isolating traffic per host.
+  - **Transparent Service Worker Interception (`fingerprint.worker.js`)**: Introduced a dedicated Service Worker and client integration (`initServiceWorker`, `syncServiceWorkerCredentials`) for transparent network request decoration (`X-Device-Fingerprint`, `X-Behavior-Metrics`). This avoids monkey-patching `window.fetch` directly, keeping native prototypes intact to prevent prototype tampering triggers while supporting domain-scoped protection.
+- ⚖️ **Scoring Parity & Enhancements**:
+  - **`behaviorScore` Overhaul**: Reworked the behavioral scoring logic across all supported languages (Node.js, PHP, Java, Python) for more accurate detection of human-like interactions versus automated patterns.
+  - **`x-behavior-metrics` Direct Score & Binary Flag Support**: Added support for direct evaluation of client-side binary flags (`1` for verified human yielding a score of `0`, `0` for detected bot yielding a score of `100`) as well as raw numeric suspicion scores passed in the `x-behavior-metrics` header. (Contributed by @anonympins)
+  - **Cross-Language Weight Parity**: Harmonized the weights within all security profiles to ensure identical scoring and behavior across every runtime environment.
+  - **HTTP/2 Pseudo-Header Validation**: Hardened `protocolAnomalyScore` to detect and penalize invalid pseudo-headers in HTTP/2 fingerprints, improving detection of non-standard and bot-like clients.
+  - **Java Engine Parity**: The Java engine's auto-tuner and configuration management have been brought to full parity with the other language implementations.
+- 🔧 **Fixes & Maintenance**:
+  - Corrected library import paths and expanded test coverage for the updated `behaviorScore` logic.
+
+## Version 0.7.3
+
+- 🛡️ **Scoring Corrections & Anti-Spoofing Fixes**:
+  - **TLS Spoofing Score Fix**: Resolved false positive detections where legitimate Chrome browsers were erroneously flagged as spoofed (`tlsSpoofingScore`), improving GREASE cipher/extension inspection and ALPN protocol validation.
+  - **Threat Intelligence Rework (`threatIntelScore`)**: Overhauled the threat intelligence scoring mechanism, refining the correlation between low-level TCP RTT and application-layer transit discrepancies while streamlining federated ZKP blacklist checks.
+- 🌐 **Cross-Language Score Parity**:
+  - Resolved calculation discrepancies and harmonized scoring formulas across Node.js, PHP, and Java implementations to guarantee deterministic and identical results across all runtimes.
+  - Fixed all known scoring edge cases primarily affecting the Node.js module.
+- 🔌 **WordPress Plugin Hardening & Compliance**:
+  - **Full WordPress Plugin Check Compliance**: Resolved all errors, warnings, and notices reported by the official WordPress Plugin Check tool, ensuring strict adherence to WordPress coding and security standards.
+- 👥 **Contributors**:
+  - Contributed by @anonympins.
+
 ## Version 0.7.2
 
 - 🔌 **WordPress Plugin Enhancements**:
-  - `🌐 **Full Internationalization (i18n)**: The WordPress plugin is now fully translated into French (fr_FR) and German (de_DE), providing a native experience for administrators in those languages.`
-  - `🐛 **HTTP Fallback Fix**: Resolved a critical issue where challenges would fail on non-HTTPS (HTTP) sites. The system now transparently falls back to a secure server-side validation mechanism when the browser's `crypto.subtle` API is unavailable, ensuring functionality in all environments.`
+  - 🌐 **Full Internationalization (i18n)**: The WordPress plugin is now fully translated into French (fr_FR) and German (de_DE), providing a native experience for administrators in those languages.
+  - 🐛 **HTTP Fallback Fix**: Resolved a critical issue where challenges would fail on non-HTTPS (HTTP) sites. The system now transparently falls back to a secure server-side validation mechanism when the browser's `crypto.subtle` API is unavailable, ensuring functionality in all environments.
 - 🛡️ **Security & Bot Detection Hardening**:
-  - `🔐 **Obfuscated Client Script (`fingerprint.client.obfuscated.js`)**: Introduced a new build step that generates a heavily obfuscated version of the client-side library. This makes reverse-engineering of the fingerprinting and behavioral analysis logic significantly more difficult for attackers.`
-  - `🤖 **Default Bot Whitelist**: The engine now applies a comprehensive default whitelist for major search engine crawlers (Googlebot, Bingbot, Yandex, etc.) out-of-the-box. This ensures zero-configuration SEO compatibility and prevents legitimate bots from being challenged.`
-  - `📡 **Updated Googlebot IPs**: The list of official Googlebot IP ranges has been updated to ensure the latest crawlers are correctly identified and allowed.`
+  - 🔐 **Obfuscated Client Script (`fingerprint.client.obfuscated.js`)**: Introduced a new build step that generates a heavily obfuscated version of the client-side library. This makes reverse-engineering of the fingerprinting and behavioral analysis logic significantly more difficult for attackers.
+  - 🤖 **Default Bot Whitelist**: The engine now applies a comprehensive default whitelist for major search engine crawlers (Googlebot, Bingbot, Yandex, etc.) out-of-the-box. This ensures zero-configuration SEO compatibility and prevents legitimate bots from being challenged.
+  - 📡 **Updated Googlebot IPs**: The list of official Googlebot IP ranges has been updated to ensure the latest crawlers are correctly identified and allowed.
 - 🔧 **Developer Experience & Debugging**:
-  - `📝 **Reverse DNS Logging**: Added detailed logging to the bot verification workflow. This provides clear insights into the reverse and forward DNS lookup process, making it easier to debug whitelisting and identify spoofing attempts.`
+  - 📝 **Reverse DNS Logging**: Added detailed logging to the bot verification workflow. This provides clear insights into the reverse and forward DNS lookup process, making it easier to debug whitelisting and identify spoofing attempts.
 
 ## Version 0.7.1
 
-- 🔌 **Native WordPress Plugin Integration (`fingerprint-wordpress`)**:
-  - Full official WordPress plugin integration (`fingerprint-wordpress.php`) without external runtime dependencies, leveraging `$wpdb` through a dedicated `WpDbStore` adapter.
+- 🔌 **Native WordPress Plugin Integration (`fingerprint-anti-bot`)**:
+  - Full official WordPress plugin integration (`fingerprint-anti-bot.php`) without external runtime dependencies, leveraging `$wpdb` through a dedicated `WpDbStore` adapter.
   - Automatic SQL cache table provisioning and periodic cleanup of expired tickets via WP-Cron (`fingerprint_prune_expired_entries`).
-  - Automated packaging script (`package.php`) generating a ready-to-deploy ZIP archive (`fingerprint-wordpress.zip`).
+  - Automated packaging script (`package.php`) generating a ready-to-deploy ZIP archive (`fingerprint-anti-bot.zip`).
   - Cross-environment honeypot tripwires: immediately detects and drops automated scanners probing for non-WordPress entrypoints (Laravel, Symfony, Django, Spring Boot `/actuator`, phpMyAdmin, `.env`, `.git`).
   - Admin dashboard security notice if running over unencrypted HTTP (warning about modern browsers disabling native `crypto.subtle` APIs in insecure contexts).
 - 🔬 **JavaScript Prototype Tampering Detection (`detectTamperedPrototypes`)**:

package/README.md

@@ -91,7 +91,7 @@ In your **pom.xml**, add :
 <dependency>
     <groupId>com.anonympins</groupId>
     <artifactId>fingerprint-engine</artifactId>
-    <version>0.7.2</version>
+    <version>0.7.4</version>
 </dependency>
 ```
 ## Documentation

package/package.json

@@ -1,107 +1,109 @@
-{
-  "name": "@anonympins/fingerprint",
-  "version": "0.7.2",
-  "description": "Advanced anti-bot library for Node.js using multi-layer fingerprinting (JA3, client-side, headers), behavioral analysis, and adaptive Proof-of-Work (PoW) challenges to mitigate scraping, scalping, and automated threats.",
-  "main": "index.js",
-  "type": "module",
-  "engines": {
-    "node": ">=20.0.0"
-  },
-  "scripts": {
-    "test": "vitest run --reporter=verbose",
-    "pub": "npm run build && npm login && npm publish --access public",
-    "build": "node src/js/build-client.js"
-  },
-  "exports": {
-    ".": "./index.js",
-    "./client": {
-      "import": "./src/js/fingerprint.client.obfuscated.js",
-      "require": "./src/js/fingerprint.client.obfuscated.js",
-      "browser": "./src/js/fingerprint.client.obfuscated.js"
-    },
-    "./client/src/*": "./src/js/*",
-    "./fp.wasm": "./public/fp.wasm",
-    "./fp.js": "./public/fp.js",
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "index.js",
-    "src/js/",
-    "public/",
-    "README.md",
-    "LICENSE",
-    "CHANGELOG.md",
-    "src/php/",
-    "composer.json",
-    "phpunit.xml"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/anonympins/fingerprint.git"
-  },
-  "keywords": [
-    "anti-bot",
-    "bot-detection",
-    "security",
-    "middleware",
-    "express",
-    "nodejs",
-    "fingerprint",
-    "device-fingerprinting",
-    "ja3",
-    "tls-fingerprinting",
-    "proof-of-work",
-    "pow",
-    "useful-proof-of-work",
-    "upow",
-    "waf",
-    "scraping",
-    "scalping",
-    "mitigation",
-    "rate-limiting",
-    "honeypot",
-    "behavioral-analysis"
-  ],
-  "author": "anonympins",
-  "license": "MIT",
-  "bugs": {
-    "url": "https://github.com/anonympins/fingerprint/issues"
-  },
-  "homepage": "https://github.com/anonympins/fingerprint#readme",
-  "devDependencies": {
-    "cookie-parser": "^1.4.6",
-    "express": "^4.22.2",
-    "javascript-obfuscator": "^4.1.0",
-    "jsdom": "^24.0.0",
-    "prom-client": "^15.1.2",
-    "terser": "^5.30.3",
-    "vitest": "^4.1.11"
-  },
-  "overrides": {
-    "body-parser": "2.3.0",
-    "qs": "6.16.0"
-  },
-  "peerDependencies": {
-    "ioredis": "^5.3.2",
-    "knex": ">=3.0.0",
-    "mongodb": "^6.3.0",
-    "sqlite3": "^5.1.7"
-  },
-  "peerDependenciesMeta": {
-    "ioredis": {
-      "optional": true
-    },
-    "mongodb": {
-      "optional": true
-    },
-    "knex": {
-      "optional": true
-    },
-    "sqlite3": {
-      "optional": true
-    }
-  },
-  "dependencies": {
-    "@tensorflow/tfjs": "^4.22.0"
-  }
-}
+{
+  "name": "@anonympins/fingerprint",
+  "version": "0.7.4",
+  "description": "Advanced anti-bot library for Node.js using multi-layer fingerprinting (JA3, client-side, headers), behavioral analysis, and adaptive Proof-of-Work (PoW) challenges to mitigate scraping, scalping, and automated threats.",
+  "main": "index.js",
+  "type": "module",
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "scripts": {
+    "test": "vitest run --reporter=verbose",
+    "pub": "npm run build && npm login && npm publish --access public",
+    "build": "node src/js/build-client.js"
+  },
+  "exports": {
+    ".": "./index.js",
+    "./client": {
+      "import": "./src/js/fingerprint.client.obfuscated.js",
+      "browser": "./src/js/fingerprint.client.obfuscated.js"
+    },
+    "./worker": {
+      "import": "./src/js/fingerprint.worker.js",
+      "default": "./src/js/fingerprint.worker.js"
+    },
+    "./fp.wasm": "./public/fp.wasm",
+    "./fp.js": "./public/fp.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "index.js",
+    "src/js/",
+    "public/",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md",
+    "src/php/",
+    "composer.json",
+    "phpunit.xml"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/anonympins/fingerprint.git"
+  },
+  "keywords": [
+    "anti-bot",
+    "bot-detection",
+    "security",
+    "middleware",
+    "express",
+    "nodejs",
+    "fingerprint",
+    "device-fingerprinting",
+    "ja3",
+    "tls-fingerprinting",
+    "proof-of-work",
+    "pow",
+    "useful-proof-of-work",
+    "upow",
+    "waf",
+    "scraping",
+    "scalping",
+    "mitigation",
+    "rate-limiting",
+    "honeypot",
+    "behavioral-analysis"
+  ],
+  "author": "anonympins",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/anonympins/fingerprint/issues"
+  },
+  "homepage": "https://github.com/anonympins/fingerprint#readme",
+  "devDependencies": {
+    "cookie-parser": "^1.4.6",
+    "express": "^4.22.2",
+    "javascript-obfuscator": "^4.1.0",
+    "jsdom": "^24.0.0",
+    "prom-client": "^15.1.2",
+    "terser": "^5.30.3",
+    "vitest": "^4.1.11"
+  },
+  "overrides": {
+    "body-parser": "2.3.0",
+    "qs": "6.16.0"
+  },
+  "peerDependencies": {
+    "ioredis": "^5.3.2",
+    "knex": ">=3.0.0",
+    "mongodb": "^6.3.0",
+    "sqlite3": "^5.1.7"
+  },
+  "peerDependenciesMeta": {
+    "ioredis": {
+      "optional": true
+    },
+    "mongodb": {
+      "optional": true
+    },
+    "knex": {
+      "optional": true
+    },
+    "sqlite3": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "@tensorflow/tfjs": "^4.22.0"
+  }
+}