@blamejs/exceptd-skills 0.16.15 → 0.16.17

package/data/cwe-catalog.json

@@ -88,6 +88,7 @@
     "skills_referencing": [
       "api-security",
       "attack-surface-pentest",
+      "decompression-dos",
       "mail-server-hardening",
       "mcp-agent-trust",
       "webapp-security"
@@ -1844,6 +1845,7 @@
       "identity-assurance",
       "idp-incident-response",
       "mail-server-hardening",
+      "multitenancy-isolation",
       "sector-financial",
       "vc-wallet-trust",
       "webapp-security"
@@ -3070,7 +3072,9 @@
     "_auto_imported": true,
     "_intake_method": "v0.13.18-bulk-mitre-cwe-curated",
     "skills_referencing": [
-      "mail-server-hardening"
+      "decompression-dos",
+      "mail-server-hardening",
+      "multitenancy-isolation"
     ]
   },
   "CWE-285": {
@@ -3577,7 +3581,10 @@
     "last_verified": "2026-05-19",
     "notes": "Bulk-imported v0.13.18 from the canonical MITRE Top 25 + commonly-referenced-class expansion.",
     "_auto_imported": true,
-    "_intake_method": "v0.13.18-bulk-mitre-cwe-curated"
+    "_intake_method": "v0.13.18-bulk-mitre-cwe-curated",
+    "skills_referencing": [
+      "multitenancy-isolation"
+    ]
   },
   "CWE-640": {
     "id": "CWE-640",
@@ -3773,7 +3780,11 @@
     "last_verified": "2026-05-19",
     "notes": "Bulk-imported v0.13.18 from the canonical MITRE Top 25 + commonly-referenced-class expansion.",
     "_auto_imported": true,
-    "_intake_method": "v0.13.18-bulk-mitre-cwe-curated"
+    "_intake_method": "v0.13.18-bulk-mitre-cwe-curated",
+    "skills_referencing": [
+      "decompression-dos",
+      "multitenancy-isolation"
+    ]
   },
   "CWE-772": {
     "id": "CWE-772",
@@ -3811,7 +3822,10 @@
     "last_verified": "2026-05-19",
     "notes": "Bulk-imported v0.13.18 from the canonical MITRE Top 25 + commonly-referenced-class expansion.",
     "_auto_imported": true,
-    "_intake_method": "v0.13.18-bulk-mitre-cwe-curated"
+    "_intake_method": "v0.13.18-bulk-mitre-cwe-curated",
+    "skills_referencing": [
+      "decompression-dos"
+    ]
   },
   "CWE-778": {
     "id": "CWE-778",
@@ -3871,7 +3885,10 @@
     "last_verified": "2026-05-19",
     "notes": "Bulk-imported v0.13.18 from the canonical MITRE Top 25 + commonly-referenced-class expansion.",
     "_auto_imported": true,
-    "_intake_method": "v0.13.18-bulk-mitre-cwe-curated"
+    "_intake_method": "v0.13.18-bulk-mitre-cwe-curated",
+    "skills_referencing": [
+      "decompression-dos"
+    ]
   },
   "CWE-835": {
     "id": "CWE-835",
@@ -4462,7 +4479,10 @@
       "CVE-2024-21626"
     ],
     "last_verified": "2026-05-19",
-    "notes": "Added v0.13.19 to back the runc /proc/self/fd container-escape (CVE-2024-21626) cwe_refs entry."
+    "notes": "Added v0.13.19 to back the runc /proc/self/fd container-escape (CVE-2024-21626) cwe_refs entry.",
+    "skills_referencing": [
+      "multitenancy-isolation"
+    ]
   },
   "CWE-340": {
     "id": "CWE-340",
@@ -4543,5 +4563,43 @@
       "CVE-2023-51765",
       "CVE-2023-51766"
     ]
+  },
+  "CWE-409": {
+    "id": "CWE-409",
+    "name": "Improper Handling of Highly Compressed Data (Data Amplification)",
+    "abstraction": "Base",
+    "category": "Resource Management",
+    "description": "The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output. MITRE-canonical; full text at https://cwe.mitre.org/data/definitions/409.html. Backs the decompression-bomb / zip-bomb / nested-archive class (no decompressed-size or ratio cap).",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000"
+    ],
+    "related_attack_patterns_capec": [
+      "CAPEC-197"
+    ],
+    "skills_referencing": [
+      "decompression-dos"
+    ],
+    "evidence_cves": []
+  },
+  "CWE-1333": {
+    "id": "CWE-1333",
+    "name": "Inefficient Regular Expression Complexity",
+    "abstraction": "Base",
+    "category": "Resource Management",
+    "description": "The product uses a regular expression with inefficient, possibly exponential worst-case complexity on a value that can be controlled by an actor, enabling catastrophic backtracking (ReDoS). MITRE-canonical; full text at https://cwe.mitre.org/data/definitions/1333.html.",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000"
+    ],
+    "related_attack_patterns_capec": [
+      "CAPEC-492"
+    ],
+    "skills_referencing": [
+      "decompression-dos"
+    ],
+    "evidence_cves": []
   }
 }

package/data/playbooks/cloud-iam-incident.json

@@ -60,7 +60,8 @@
       }
     ],
     "fed_by": [
-      "identity-sso-compromise"
+      "identity-sso-compromise",
+      "multitenancy-isolation"
     ]
   },
   "domain": {
@@ -976,7 +977,15 @@
             "rotation_ownership_identified == true"
           ],
           "priority": 1,
-          "for_signals": ["root_login_from_new_asn","iam_access_key_created_no_iac_ticket","mass_iam_user_creation_outside_iac","cross_account_assume_role_anomaly","kms_key_policy_self_grant","s3_bucket_policy_public_grant","cloudtrail_logging_disabled_event"],
+          "for_signals": [
+            "root_login_from_new_asn",
+            "iam_access_key_created_no_iac_ticket",
+            "mass_iam_user_creation_outside_iac",
+            "cross_account_assume_role_anomaly",
+            "kms_key_policy_self_grant",
+            "s3_bucket_policy_public_grant",
+            "cloudtrail_logging_disabled_event"
+          ],
           "compensating_controls": [
             "session-revocation",
             "audit-log-review-for-misuse-window",
@@ -992,7 +1001,15 @@
             "iam_read_only_across_org == true"
           ],
           "priority": 2,
-          "for_signals": ["cross_account_assume_role_anomaly","mass_iam_user_creation_outside_iac","iam_access_key_created_no_iac_ticket","kms_key_policy_self_grant","s3_bucket_policy_public_grant","gpu_instance_creation_spike","unused_region_resource_creation"],
+          "for_signals": [
+            "cross_account_assume_role_anomaly",
+            "mass_iam_user_creation_outside_iac",
+            "iam_access_key_created_no_iac_ticket",
+            "kms_key_policy_self_grant",
+            "s3_bucket_policy_public_grant",
+            "gpu_instance_creation_spike",
+            "unused_region_resource_creation"
+          ],
           "compensating_controls": [
             "iam-event-review-completed",
             "scp-tightened",
@@ -1007,7 +1024,9 @@
             "imdsv2_migration_blocker_inventory_complete == true"
           ],
           "priority": 2,
-          "for_signals": ["imds_v1_legacy_access"],
+          "for_signals": [
+            "imds_v1_legacy_access"
+          ],
           "compensating_controls": [
             "imdsv2-enforced-org-wide",
             "scp-deny-imdsv1-launch"
@@ -1021,7 +1040,9 @@
             "federated_trust_inventory_complete == true"
           ],
           "priority": 2,
-          "for_signals": ["cross_account_assume_role_anomaly"],
+          "for_signals": [
+            "cross_account_assume_role_anomaly"
+          ],
           "compensating_controls": [
             "federated-trust-tightened",
             "conditional-access-mfa-required-on-admin"

package/data/playbooks/crypto-codebase.json

@@ -57,6 +57,9 @@
         "playbook_id": "secrets",
         "condition": "analyze.classification == 'detected'"
       }
+    ],
+    "fed_by": [
+      "decompression-dos"
     ]
   },
   "domain": {
@@ -959,7 +962,11 @@
             "api_stability_promise_permits_default_change == true OR major_version_bump_planned == true"
           ],
           "priority": 1,
-          "for_signals": ["no-ml-kem-implementation","rsa-1024-anywhere","tls-old-protocol"],
+          "for_signals": [
+            "no-ml-kem-implementation",
+            "rsa-1024-anywhere",
+            "tls-old-protocol"
+          ],
           "compensating_controls": [
             "config_flag_for_classical_only_fallback_with_deprecation_warning",
             "downstream_consumer_migration_guide_published"
@@ -974,7 +981,9 @@
             "downstream_consumer_compat_path_planned == true"
           ],
           "priority": 2,
-          "for_signals": ["ecdsa-without-pqc-roadmap"],
+          "for_signals": [
+            "ecdsa-without-pqc-roadmap"
+          ],
           "compensating_controls": [
             "dual_signature_envelope_during_migration",
             "explicit_algorithm_identifier_in_signed_payload"
@@ -988,7 +997,10 @@
             "weak_hash_call_sites_inventoried == true"
           ],
           "priority": 3,
-          "for_signals": ["weak-hash-import","weak-cipher-mode"],
+          "for_signals": [
+            "weak-hash-import",
+            "weak-cipher-mode"
+          ],
           "compensating_controls": [
             "deprecation_warning_emitted_when_legacy_hash_method_invoked",
             "telemetry_to_track_legacy_method_consumer_usage"
@@ -1003,7 +1015,10 @@
             "performance_regression_acceptable_in_current_release == true"
           ],
           "priority": 4,
-          "for_signals": ["pbkdf2-under-iterated","bcrypt-cost-low"],
+          "for_signals": [
+            "pbkdf2-under-iterated",
+            "bcrypt-cost-low"
+          ],
           "compensating_controls": [
             "kdf_parameter_floor_enforced_at_runtime_not_just_default",
             "consumer_documentation_about_password_rehash_on_login_for_legacy_storage"
@@ -1017,7 +1032,9 @@
             "rng_call_sites_inventoried == true"
           ],
           "priority": 5,
-          "for_signals": ["math-random-in-security-path"],
+          "for_signals": [
+            "math-random-in-security-path"
+          ],
           "compensating_controls": [
             "linter_rule_added_to_ci",
             "data_flow_analysis_for_residual_paths"
@@ -1031,7 +1048,9 @@
             "fips_provider_available_in_target_dep == true"
           ],
           "priority": 6,
-          "for_signals": ["fips-claim-without-runtime-activation"],
+          "for_signals": [
+            "fips-claim-without-runtime-activation"
+          ],
           "compensating_controls": [
             "fips_runtime_assertion_in_init_path",
             "ci_job_running_against_fips_provider_config"
@@ -1045,7 +1064,9 @@
             "vendored_crypto_inventoried == true"
           ],
           "priority": 7,
-          "for_signals": ["vendored-pqc-no-provenance"],
+          "for_signals": [
+            "vendored-pqc-no-provenance"
+          ],
           "compensating_controls": [
             "vendored_copy_pinned_to_release_tag_not_branch",
             "automated_upstream_security_advisory_subscription"
@@ -1059,7 +1080,9 @@
             "api_change_acceptable_in_next_major == true"
           ],
           "priority": 8,
-          "for_signals": ["no-crypto-agility-abstraction"],
+          "for_signals": [
+            "no-crypto-agility-abstraction"
+          ],
           "compensating_controls": [
             "deprecation_path_for_old_api",
             "migration_guide_published"