@blamejs/exceptd-skills 0.12.41 → 0.13.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (83) hide show
  1. package/CHANGELOG.md +124 -0
  2. package/bin/exceptd.js +52 -44
  3. package/data/_indexes/_meta.json +49 -49
  4. package/data/_indexes/activity-feed.json +2 -2
  5. package/data/_indexes/catalog-summaries.json +2 -2
  6. package/data/_indexes/chains.json +1531 -575
  7. package/data/_indexes/jurisdiction-map.json +15 -4
  8. package/data/_indexes/section-offsets.json +1244 -1244
  9. package/data/_indexes/token-budget.json +173 -173
  10. package/data/atlas-ttps.json +55 -11
  11. package/data/attack-techniques.json +124 -19
  12. package/data/cve-catalog.json +194 -27
  13. package/data/cwe-catalog.json +15 -5
  14. package/data/framework-control-gaps.json +32 -10
  15. package/data/playbooks/ai-api.json +5 -0
  16. package/data/playbooks/cicd-pipeline-compromise.json +970 -0
  17. package/data/playbooks/cloud-iam-incident.json +4 -1
  18. package/data/playbooks/cred-stores.json +10 -0
  19. package/data/playbooks/framework.json +16 -0
  20. package/data/playbooks/hardening.json +4 -0
  21. package/data/playbooks/identity-sso-compromise.json +951 -0
  22. package/data/playbooks/idp-incident.json +3 -0
  23. package/data/playbooks/kernel.json +6 -0
  24. package/data/playbooks/llm-tool-use-exfil.json +963 -0
  25. package/data/playbooks/mcp.json +6 -0
  26. package/data/playbooks/runtime.json +4 -0
  27. package/data/playbooks/sbom.json +13 -0
  28. package/data/playbooks/secrets.json +6 -0
  29. package/data/playbooks/webhook-callback-abuse.json +916 -0
  30. package/data/zeroday-lessons.json +178 -0
  31. package/lib/cross-ref-api.js +33 -13
  32. package/lib/cve-curation.js +12 -1
  33. package/lib/exit-codes.js +29 -0
  34. package/lib/lint-skills.js +24 -2
  35. package/lib/refresh-external.js +17 -1
  36. package/lib/scoring.js +55 -0
  37. package/lib/source-advisories.js +281 -0
  38. package/manifest.json +83 -83
  39. package/orchestrator/index.js +207 -24
  40. package/package.json +1 -1
  41. package/sbom.cdx.json +134 -79
  42. package/scripts/predeploy.js +7 -13
  43. package/scripts/refresh-reverse-refs.js +86 -0
  44. package/scripts/refresh-sbom.js +21 -4
  45. package/skills/age-gates-child-safety/skill.md +1 -5
  46. package/skills/ai-attack-surface/skill.md +11 -4
  47. package/skills/ai-c2-detection/skill.md +11 -2
  48. package/skills/ai-risk-management/skill.md +4 -2
  49. package/skills/api-security/skill.md +7 -8
  50. package/skills/attack-surface-pentest/skill.md +2 -2
  51. package/skills/cloud-iam-incident/skill.md +1 -5
  52. package/skills/cloud-security/skill.md +0 -4
  53. package/skills/compliance-theater/skill.md +10 -2
  54. package/skills/container-runtime-security/skill.md +1 -3
  55. package/skills/dlp-gap-analysis/skill.md +3 -4
  56. package/skills/email-security-anti-phishing/skill.md +1 -8
  57. package/skills/exploit-scoring/skill.md +7 -2
  58. package/skills/framework-gap-analysis/skill.md +1 -1
  59. package/skills/fuzz-testing-strategy/skill.md +1 -2
  60. package/skills/global-grc/skill.md +3 -2
  61. package/skills/identity-assurance/skill.md +1 -3
  62. package/skills/idp-incident-response/skill.md +1 -4
  63. package/skills/incident-response-playbook/skill.md +1 -5
  64. package/skills/kernel-lpe-triage/skill.md +2 -2
  65. package/skills/mcp-agent-trust/skill.md +13 -3
  66. package/skills/mlops-security/skill.md +2 -3
  67. package/skills/ot-ics-security/skill.md +0 -3
  68. package/skills/policy-exception-gen/skill.md +11 -3
  69. package/skills/pqc-first/skill.md +4 -2
  70. package/skills/rag-pipeline-security/skill.md +2 -0
  71. package/skills/ransomware-response/skill.md +1 -5
  72. package/skills/researcher/skill.md +4 -3
  73. package/skills/sector-energy/skill.md +0 -4
  74. package/skills/sector-federal-government/skill.md +2 -3
  75. package/skills/sector-financial/skill.md +1 -4
  76. package/skills/sector-healthcare/skill.md +0 -5
  77. package/skills/sector-telecom/skill.md +0 -4
  78. package/skills/security-maturity-tiers/skill.md +1 -2
  79. package/skills/skill-update-loop/skill.md +4 -3
  80. package/skills/supply-chain-integrity/skill.md +4 -3
  81. package/skills/threat-model-currency/skill.md +1 -1
  82. package/skills/threat-modeling-methodology/skill.md +2 -1
  83. package/skills/webapp-security/skill.md +0 -5
package/data/atlas-ttps.json CHANGED
@@ -83,7 +83,10 @@
83
83
  ],
84
84
  "secure_ai_v2_layer": true,
85
85
  "maturity": "high",
86
- "last_verified": "2026-05-15"
86
+ "last_verified": "2026-05-15",
87
+ "cve_refs": [
88
+ "CVE-2026-42945"
89
+ ]
87
90
  },
88
91
  "AML.T0010": {
89
92
  "id": "AML.T0010",
@@ -121,7 +124,16 @@
121
124
  ],
122
125
  "secure_ai_v2_layer": true,
123
126
  "maturity": "high",
124
- "last_verified": "2026-05-15"
127
+ "last_verified": "2026-05-15",
128
+ "cve_refs": [
129
+ "CVE-2026-30615",
130
+ "CVE-2026-39987",
131
+ "CVE-2026-45321",
132
+ "MAL-2026-3083",
133
+ "MAL-2026-NODE-IPC-STEALER",
134
+ "MAL-2026-SHAI-HULUD-OSS",
135
+ "MAL-2026-TANSTACK-MINI"
136
+ ]
125
137
  },
126
138
  "AML.T0016": {
127
139
  "id": "AML.T0016",
@@ -149,7 +161,10 @@
149
161
  ],
150
162
  "secure_ai_v2_layer": true,
151
163
  "maturity": "moderate",
152
- "last_verified": "2026-05-15"
164
+ "last_verified": "2026-05-15",
165
+ "cve_refs": [
166
+ "CVE-2026-30615"
167
+ ]
153
168
  },
154
169
  "AML.T0017": {
155
170
  "id": "AML.T0017",
@@ -220,7 +235,11 @@
220
235
  ],
221
236
  "secure_ai_v2_layer": true,
222
237
  "maturity": "moderate",
223
- "last_verified": "2026-05-15"
238
+ "last_verified": "2026-05-15",
239
+ "cve_refs": [
240
+ "CVE-2026-45321",
241
+ "MAL-2026-3083"
242
+ ]
224
243
  },
225
244
  "AML.T0020": {
226
245
  "id": "AML.T0020",
@@ -252,7 +271,10 @@
252
271
  ],
253
272
  "secure_ai_v2_layer": true,
254
273
  "maturity": "high",
255
- "last_verified": "2026-05-15"
274
+ "last_verified": "2026-05-15",
275
+ "cve_refs": [
276
+ "MAL-2026-NODE-IPC-STEALER"
277
+ ]
256
278
  },
257
279
  "AML.T0024": {
258
280
  "id": "AML.T0024",
@@ -379,7 +401,10 @@
379
401
  "exceptd_skills": [],
380
402
  "secure_ai_v2_layer": true,
381
403
  "maturity": "moderate",
382
- "last_verified": "2026-05-15"
404
+ "last_verified": "2026-05-15",
405
+ "cve_refs": [
406
+ "CVE-2026-45321"
407
+ ]
383
408
  },
384
409
  "AML.T0051": {
385
410
  "id": "AML.T0051",
@@ -420,7 +445,13 @@
420
445
  ],
421
446
  "secure_ai_v2_layer": true,
422
447
  "maturity": "high",
423
- "last_verified": "2026-05-15"
448
+ "last_verified": "2026-05-15",
449
+ "cve_refs": [
450
+ "CVE-2025-53773",
451
+ "CVE-2026-30615",
452
+ "CVE-2026-39884",
453
+ "CVE-2026-39987"
454
+ ]
424
455
  },
425
456
  "AML.T0053": {
426
457
  "id": "AML.T0053",
@@ -450,7 +481,10 @@
450
481
  "exceptd_skills": [],
451
482
  "secure_ai_v2_layer": true,
452
483
  "maturity": "high",
453
- "last_verified": "2026-05-15"
484
+ "last_verified": "2026-05-15",
485
+ "cve_refs": [
486
+ "CVE-2026-39884"
487
+ ]
454
488
  },
455
489
  "AML.T0054": {
456
490
  "id": "AML.T0054",
@@ -481,7 +515,10 @@
481
515
  ],
482
516
  "secure_ai_v2_layer": true,
483
517
  "maturity": "high",
484
- "last_verified": "2026-05-15"
518
+ "last_verified": "2026-05-15",
519
+ "cve_refs": [
520
+ "CVE-2025-53773"
521
+ ]
485
522
  },
486
523
  "AML.T0055": {
487
524
  "id": "AML.T0055",
@@ -511,7 +548,11 @@
511
548
  "exceptd_skills": [],
512
549
  "secure_ai_v2_layer": true,
513
550
  "maturity": "moderate",
514
- "last_verified": "2026-05-15"
551
+ "last_verified": "2026-05-15",
552
+ "cve_refs": [
553
+ "CVE-2026-42208",
554
+ "MAL-2026-3083"
555
+ ]
515
556
  },
516
557
  "AML.T0057": {
517
558
  "id": "AML.T0057",
@@ -582,7 +623,10 @@
582
623
  ],
583
624
  "secure_ai_v2_layer": true,
584
625
  "maturity": "high",
585
- "last_verified": "2026-05-15"
626
+ "last_verified": "2026-05-15",
627
+ "cve_refs": [
628
+ "CVE-2026-30615"
629
+ ]
586
630
  },
587
631
  "AML.T0097": {
588
632
  "id": "AML.T0097",
package/data/attack-techniques.json CHANGED
@@ -66,6 +66,9 @@
66
66
  "tactic_id": "TA0005",
67
67
  "detection_strategies": [
68
68
  "DS0009"
69
+ ],
70
+ "cve_refs": [
71
+ "CVE-2026-32202"
69
72
  ]
70
73
  },
71
74
  "T1040": {
@@ -74,7 +77,10 @@
74
77
  },
75
78
  "T1041": {
76
79
  "name": "Exfiltration Over C2 Channel",
77
- "version": "v19"
80
+ "version": "v19",
81
+ "cve_refs": [
82
+ "CVE-2026-30615"
83
+ ]
78
84
  },
79
85
  "T1053.003": {
80
86
  "name": "Scheduled Task/Job: Cron",
@@ -91,23 +97,51 @@
91
97
  "detection_strategies": [
92
98
  "DS0009",
93
99
  "DS0017"
100
+ ],
101
+ "cve_refs": [
102
+ "CVE-2025-53773",
103
+ "CVE-2026-30615",
104
+ "CVE-2026-32202",
105
+ "CVE-2026-39884",
106
+ "CVE-2026-39987",
107
+ "CVE-2026-6973"
94
108
  ]
95
109
  },
96
110
  "T1059.001": {
97
111
  "name": "Command and Scripting Interpreter: PowerShell",
98
- "version": "v19"
112
+ "version": "v19",
113
+ "cve_refs": [
114
+ "CVE-2025-53773"
115
+ ]
99
116
  },
100
117
  "T1059.006": {
101
118
  "name": "Command and Scripting Interpreter: Python",
102
- "version": "v19"
119
+ "version": "v19",
120
+ "cve_refs": [
121
+ "MAL-2026-3083"
122
+ ]
103
123
  },
104
124
  "T1059.007": {
105
125
  "name": "Command and Scripting Interpreter: JavaScript",
106
- "version": "v19"
126
+ "version": "v19",
127
+ "cve_refs": [
128
+ "CVE-2026-45321",
129
+ "MAL-2026-NODE-IPC-STEALER"
130
+ ]
107
131
  },
108
132
  "T1068": {
109
133
  "name": "Exploitation for Privilege Escalation",
110
- "version": "v19"
134
+ "version": "v19",
135
+ "cve_refs": [
136
+ "CVE-2026-0300",
137
+ "CVE-2026-31431",
138
+ "CVE-2026-33825",
139
+ "CVE-2026-43284",
140
+ "CVE-2026-43500",
141
+ "CVE-2026-46300",
142
+ "CVE-2026-46333",
143
+ "CVE-2026-6973"
144
+ ]
111
145
  },
112
146
  "T1071": {
113
147
  "name": "Application Layer Protocol",
@@ -115,11 +149,22 @@
115
149
  },
116
150
  "T1078": {
117
151
  "name": "Valid Accounts",
118
- "version": "v19"
152
+ "version": "v19",
153
+ "cve_refs": [
154
+ "CVE-2026-33825",
155
+ "CVE-2026-39884",
156
+ "CVE-2026-42897",
157
+ "CVE-2026-6973",
158
+ "MAL-2026-NODE-IPC-STEALER",
159
+ "MAL-2026-SHAI-HULUD-OSS"
160
+ ]
119
161
  },
120
162
  "T1078.001": {
121
163
  "name": "Valid Accounts: Default Accounts",
122
- "version": "v19"
164
+ "version": "v19",
165
+ "cve_refs": [
166
+ "CVE-2026-42208"
167
+ ]
123
168
  },
124
169
  "T1078.002": {
125
170
  "name": "Valid Accounts: Domain Accounts",
@@ -131,7 +176,11 @@
131
176
  },
132
177
  "T1078.004": {
133
178
  "name": "Valid Accounts: Cloud Accounts",
134
- "version": "v19"
179
+ "version": "v19",
180
+ "cve_refs": [
181
+ "CVE-2026-45321",
182
+ "MAL-2026-3083"
183
+ ]
135
184
  },
136
185
  "T1098": {
137
186
  "name": "Account Manipulation",
@@ -160,7 +209,11 @@
160
209
  },
161
210
  "T1133": {
162
211
  "name": "External Remote Services",
163
- "version": "v19"
212
+ "version": "v19",
213
+ "cve_refs": [
214
+ "CVE-2026-0300",
215
+ "CVE-2026-39987"
216
+ ]
164
217
  },
165
218
  "T1136.001": {
166
219
  "name": "Create Account: Local Account",
@@ -168,7 +221,17 @@
168
221
  },
169
222
  "T1190": {
170
223
  "name": "Exploit Public-Facing Application",
171
- "version": "v19"
224
+ "version": "v19",
225
+ "cve_refs": [
226
+ "CVE-2025-53773",
227
+ "CVE-2026-0300",
228
+ "CVE-2026-32202",
229
+ "CVE-2026-39987",
230
+ "CVE-2026-42208",
231
+ "CVE-2026-42897",
232
+ "CVE-2026-42945",
233
+ "CVE-2026-6973"
234
+ ]
172
235
  },
173
236
  "T1195": {
174
237
  "name": "Supply Chain Compromise",
@@ -176,11 +239,24 @@
176
239
  },
177
240
  "T1195.001": {
178
241
  "name": "Supply Chain Compromise: Software Dependencies and Development Tools",
179
- "version": "v19"
242
+ "version": "v19",
243
+ "cve_refs": [
244
+ "CVE-2026-30615",
245
+ "MAL-2026-3083",
246
+ "MAL-2026-NODE-IPC-STEALER",
247
+ "MAL-2026-TANSTACK-MINI"
248
+ ]
180
249
  },
181
250
  "T1195.002": {
182
251
  "name": "Supply Chain Compromise: Software Supply Chain",
183
- "version": "v19"
252
+ "version": "v19",
253
+ "cve_refs": [
254
+ "CVE-2024-3094",
255
+ "CVE-2026-45321",
256
+ "MAL-2026-3083",
257
+ "MAL-2026-NODE-IPC-STEALER",
258
+ "MAL-2026-SHAI-HULUD-OSS"
259
+ ]
184
260
  },
185
261
  "T1199": {
186
262
  "name": "Trusted Relationship",
@@ -200,7 +276,10 @@
200
276
  },
201
277
  "T1485": {
202
278
  "name": "Data Destruction",
203
- "version": "v19"
279
+ "version": "v19",
280
+ "cve_refs": [
281
+ "MAL-2026-SHAI-HULUD-OSS"
282
+ ]
204
283
  },
205
284
  "T1486": {
206
285
  "name": "Data Encrypted for Impact",
@@ -245,7 +324,11 @@
245
324
  },
246
325
  "T1548.001": {
247
326
  "name": "Abuse Elevation Control Mechanism: Setuid and Setgid",
248
- "version": "v19"
327
+ "version": "v19",
328
+ "cve_refs": [
329
+ "CVE-2026-31431",
330
+ "CVE-2026-43284"
331
+ ]
249
332
  },
250
333
  "T1548.003": {
251
334
  "name": "Abuse Elevation Control Mechanism: Sudo and Sudo Caching",
@@ -257,7 +340,13 @@
257
340
  },
258
341
  "T1552.001": {
259
342
  "name": "Unsecured Credentials: Credentials In Files",
260
- "version": "v19"
343
+ "version": "v19",
344
+ "cve_refs": [
345
+ "CVE-2026-30615",
346
+ "MAL-2026-3083",
347
+ "MAL-2026-NODE-IPC-STEALER",
348
+ "MAL-2026-TANSTACK-MINI"
349
+ ]
261
350
  },
262
351
  "T1552.004": {
263
352
  "name": "Unsecured Credentials: Private Keys",
@@ -273,7 +362,10 @@
273
362
  },
274
363
  "T1554": {
275
364
  "name": "Compromise Host Software Binary",
276
- "version": "v19"
365
+ "version": "v19",
366
+ "cve_refs": [
367
+ "CVE-2024-3094"
368
+ ]
277
369
  },
278
370
  "T1555": {
279
371
  "name": "Credentials from Password Stores",
@@ -318,7 +410,11 @@
318
410
  },
319
411
  "T1566": {
320
412
  "name": "Phishing",
321
- "version": "v19"
413
+ "version": "v19",
414
+ "cve_refs": [
415
+ "CVE-2026-32202",
416
+ "CVE-2026-42897"
417
+ ]
322
418
  },
323
419
  "T1566.001": {
324
420
  "name": "Phishing: Spearphishing Attachment",
@@ -334,7 +430,10 @@
334
430
  },
335
431
  "T1567": {
336
432
  "name": "Exfiltration Over Web Service",
337
- "version": "v19"
433
+ "version": "v19",
434
+ "cve_refs": [
435
+ "MAL-2026-SHAI-HULUD-OSS"
436
+ ]
338
437
  },
339
438
  "T1568": {
340
439
  "name": "Dynamic Resolution",
@@ -351,7 +450,10 @@
351
450
  },
352
451
  "T1574": {
353
452
  "name": "Hijack Execution Flow",
354
- "version": "v19"
453
+ "version": "v19",
454
+ "cve_refs": [
455
+ "CVE-2026-45321"
456
+ ]
355
457
  },
356
458
  "T1574.005": {
357
459
  "name": "Hijack Execution Flow: Executable Installer File Permissions Weakness",
@@ -389,6 +491,9 @@
389
491
  "detection_strategies": [
390
492
  "DS0009",
391
493
  "DS0029"
494
+ ],
495
+ "cve_refs": [
496
+ "CVE-2024-21626"
392
497
  ]
393
498
  },
394
499
  "T1613": {