@blamejs/exceptd-skills 0.18.22 → 0.18.24

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (15) hide show
  1. package/CHANGELOG.md +8 -0
  2. package/README.md +1 -1
  3. package/data/_indexes/_meta.json +10 -10
  4. package/data/_indexes/activity-feed.json +15 -15
  5. package/data/_indexes/catalog-summaries.json +10 -10
  6. package/data/_indexes/chains.json +132282 -343
  7. package/data/_indexes/frequency.json +19 -0
  8. package/data/attack-techniques.json +378 -3
  9. package/data/cve-catalog.json +18838 -61
  10. package/data/cwe-catalog.json +731 -11
  11. package/data/framework-control-gaps.json +1089 -2
  12. package/data/zeroday-lessons.json +9546 -1
  13. package/manifest.json +53 -53
  14. package/package.json +2 -2
  15. package/sbom.cdx.json +25 -25
package/CHANGELOG.md CHANGED
@@ -1,5 +1,13 @@
1
1
  # Changelog
2
2
 
3
+ ## 0.18.24 — 2026-07-21
4
+
5
+ CVE catalog currency: one hundred more CISA-KEV-listed, actively-exploited CVEs are now curated in the offline catalog (719 → 819), covering additions to the CISA Known Exploited Vulnerabilities catalog from August 2023 through March 2024 and spanning CVE publication years 2014 through 2024. Each entry carries a verified NVD CVSS vector and CWE, ATT&CK technique mappings, real-world exploitation status, primary-source indicators where public exploit code exists, global-first framework-control-gap declarations (NIST, EU NIS2/DORA, UK CAF, AU ISM/Essential 8, ISO 27001), an RWEP score, and a paired zero-day lesson. The batch is weighted toward internet-facing edge and enterprise infrastructure — the Citrix NetScaler "CitrixBleed" session-token disclosure mass-exploited by ransomware affiliates (CVE-2023-4966), the JetBrains TeamCity authentication bypass (CVE-2024-27198), the Atlassian Confluence broken-access-control and template-injection chain abused by Cerber ransomware (CVE-2023-22515, CVE-2023-22518, CVE-2023-22527), the Cisco IOS XE Web UI privilege-escalation-to-implant chain that compromised tens of thousands of devices (CVE-2023-20198, CVE-2023-20273), the F5 BIG-IP Configuration utility authentication-bypass-to-RCE pair (CVE-2023-46747, CVE-2023-46748), the SysAid path traversal used by Lace Tempest (CVE-2023-47246), the Ivanti EPMM/MobileIron authentication bypass (CVE-2023-35082), the Juniper Junos OS J-Web PHP external-variable-modification chain (CVE-2023-36844), and the Unitronics PLC insecure-default-credential flaw exploited against water utilities (CVE-2023-6448) — alongside client and mobile exploitation including the WinRAR file-name-spoofing code execution (CVE-2023-38831), the Windows SmartScreen and Internet Shortcut security-feature bypasses chained to deliver stealer and RAT payloads (CVE-2023-36025, CVE-2024-21412), the Apple "Operation Triangulation" zero-click WebKit and kernel chain (CVE-2023-41990, CVE-2023-42916, CVE-2023-42917), multiple Google Chrome/V8 zero-days (CVE-2023-4762, CVE-2023-6345, CVE-2024-0519), and the Microsoft Windows kernel privilege escalation used by Lazarus (CVE-2024-21338). Five weakness classes backing these entries are new to the CWE catalog: CWE-295 (improper certificate validation), CWE-351 (insufficient type distinction), CWE-473 (PHP external variable modification), CWE-703 (improper check or handling of exceptional conditions), and CWE-823 (use of out-of-range pointer offset).
6
+
7
+ ## 0.18.23 — 2026-07-18
8
+
9
+ CVE catalog currency: one hundred more CISA-KEV-listed, actively-exploited CVEs are now curated in the offline catalog (619 → 719), covering additions to the CISA Known Exploited Vulnerabilities catalog from March 2024 through July 2026 and spanning CVE publication years 2008 through 2026. Each entry carries a verified NVD CVSS vector and CWE, ATT&CK technique mappings, real-world exploitation status, primary-source indicators where public exploit code exists, global-first framework-control-gap declarations (NIST, EU NIS2/DORA, UK CAF, AU ISM/Essential 8, ISO 27001), an RWEP score, and a paired zero-day lesson. The batch is weighted toward internet-facing edge and enterprise infrastructure — the Palo Alto PAN-OS GlobalProtect command injection exploited as a zero-day (CVE-2024-3400), the PHP-CGI argument-injection RCE mass-exploited by TellYouThePass ransomware (CVE-2024-4577), a Linux kernel nf_tables use-after-free local privilege escalation (CVE-2024-1086), the Fortinet FortiClientEMS SQL-injection RCE (CVE-2023-48788), the Cisco ASA/FTD pair used in the ArcaneDoor campaign (CVE-2024-20353, CVE-2024-20359), the Check Point Security Gateway information disclosure (CVE-2024-24919), a VMware ESXi authentication bypass abused by ransomware affiliates (CVE-2024-37085), the OSGeo GeoServer evaluation RCE (CVE-2024-36401), the ServiceNow Now Platform input-validation RCE chain (CVE-2024-4879, CVE-2024-5217), and recent Microsoft SharePoint (CVE-2026-58644, CVE-2026-56164), Active Directory Federation Services (CVE-2026-56155), Oracle E-Business Suite (CVE-2026-46817), Fortinet FortiSandbox (CVE-2026-25089, CVE-2026-39808), and SonicWall SMA1000 (CVE-2026-15409, CVE-2026-15410) additions — alongside client and browser exploitation including six Google Chrome/V8 flaws (CVE-2024-4671, CVE-2024-4761, CVE-2024-4947, CVE-2024-5274, CVE-2024-7965, CVE-2024-7971), the Windows MSHTML spoofing flaw used by Void Banshee to deliver the Atlantida stealer (CVE-2024-43461), an Android Pixel firmware privilege escalation (CVE-2024-32896), and the Justice AV Solutions Viewer supply-chain backdoor (CVE-2024-4978). Fourteen weakness classes backing these entries are new to the CWE catalog: CWE-27, CWE-80, CWE-184, CWE-191, CWE-203, CWE-276, CWE-280, CWE-358, CWE-415, CWE-591, CWE-645, CWE-670, CWE-783, and CWE-1336.
10
+
3
11
  ## 0.18.22 — 2026-07-11
4
12
 
5
13
  CVE catalog currency: one hundred more CISA-KEV-listed, actively-exploited CVEs are now curated in the offline catalog (519 → 619), covering the most recent additions to the CISA Known Exploited Vulnerabilities catalog (September 2024 through July 2026). Each entry carries a verified NVD CVSS vector and CWE, ATT&CK technique mappings, real-world exploitation status, primary-source indicators where public exploit code exists, global-first framework-control-gap declarations (NIST, EU NIS2/DORA, UK CAF, AU ISM/Essential 8, ISO 27001), an RWEP score, and a paired zero-day lesson. The batch spans internet-facing edge and enterprise infrastructure — Palo Alto PAN-OS management auth bypass (CVE-2025-0108), SonicWall SonicOS SSLVPN authentication bypass (CVE-2024-53704), Fortinet FortiManager "FortiJump" (CVE-2024-47575) and the FortiOS fgfmd format-string RCE (CVE-2024-23113), SimpleHelp path traversal on RMM servers (CVE-2024-57727), an Ivanti Cloud Services Appliance path-traversal chain (CVE-2024-8963), Veeam Backup & Replication deserialization RCE (CVE-2024-40711), Trimble Cityworks deserialization (CVE-2025-0994), and Microsoft SharePoint code injection (CVE-2024-38094) — alongside client and mobile exploitation such as the Apple iOS USB Restricted Mode bypass used in targeted attacks (CVE-2025-24200), a Firefox animation-timeline use-after-free deployed by RomCom (CVE-2024-9680), the Windows NTLM hash-disclosure flaw (CVE-2024-43451), and an Android Framework privilege escalation (CVE-2024-43093). Two of the hundred were AI-assisted discoveries, including the PTZOptics camera command-injection pair surfaced by an LLM triaging honeypot traffic (CVE-2024-8956, CVE-2024-8957); the Langflow server-side code execution flaw is also included (CVE-2026-55255). Six weakness classes backing these entries are new to the CWE catalog: CWE-114, CWE-134, CWE-176, CWE-273, CWE-303, and CWE-425.
package/README.md CHANGED
@@ -30,7 +30,7 @@ This platform surfaces what is actually happening right now. Every skill explici
30
30
 
31
31
  ## Status
32
32
 
33
- Pre-1.0. Latest release lives on [GitHub Releases](https://github.com/blamejs/exceptd-skills/releases) and on npm as [`@blamejs/exceptd-skills`](https://www.npmjs.com/package/@blamejs/exceptd-skills) with signed npm provenance attestation and Ed25519-signed skill bodies. The package ships 51 skills across kernel LPE, MCP supply chain, AI-as-C2, prompt injection, post-quantum crypto, SBOM integrity, identity-incident response, and 35 other AI/security domains, plus 11 intelligence catalogs (CVE / ATLAS / ATT&CK / CWE / D3FEND / DLP / RFC / framework gaps / global frameworks / zero-day lessons / exploit availability) covering 35 jurisdictions; the CVE catalog holds 519 actively-exploited and high-priority entries, each carrying behavioral indicators, an ATT&CK technique mapping, and a defense-chain zero-day lesson. 33 investigation playbooks (kernel, MCP, AI-API, framework, SBOM, runtime, hardening, secrets, cred-stores, containers, crypto, plus `webhook-callback-abuse`, `cicd-pipeline-compromise`, `identity-sso-compromise`, `llm-tool-use-exfil`, `post-quantum-migration`, `ai-discovered-cve-triage`, `supply-chain-recovery`, `citation-hygiene`, `vc-wallet-trust`, `mail-server-hardening`, `network-trust`, `audit-log-integrity`, `self-update-integrity`, `multitenancy-isolation`, `decompression-dos`, `log-injection-telemetry`, `privacy-consent-ops`, and more), a CLI for discovery and investigation built around `discover → brief → run → attest` (each run executes the playbook's seven-phase contract), and a nightly auto-refresh job that pulls KEV / NVD / EPSS / GHSA / OSV / IETF deltas plus 15 primary-source advisory, research-blog, and tech-press feeds (Qualys TRU, Red Hat RHSA, Ubuntu USN, ZDI, kernel.org, oss-security, JFrog, CISA, Microsoft Security Blog, Sysdig, Trail of Bits, Embrace the Red, BleepingComputer security, and The Hacker News) into auto-PRs for editorial review, alongside a silent-regression watcher that flags historical CVEs re-broken without a new identifier.
33
+ Pre-1.0. Latest release lives on [GitHub Releases](https://github.com/blamejs/exceptd-skills/releases) and on npm as [`@blamejs/exceptd-skills`](https://www.npmjs.com/package/@blamejs/exceptd-skills) with signed npm provenance attestation and Ed25519-signed skill bodies. The package ships 51 skills across kernel LPE, MCP supply chain, AI-as-C2, prompt injection, post-quantum crypto, SBOM integrity, identity-incident response, and 35 other AI/security domains, plus 11 intelligence catalogs (CVE / ATLAS / ATT&CK / CWE / D3FEND / DLP / RFC / framework gaps / global frameworks / zero-day lessons / exploit availability) covering 35 jurisdictions; the CVE catalog holds 819 actively-exploited and high-priority entries, each carrying behavioral indicators, an ATT&CK technique mapping, and a defense-chain zero-day lesson. 33 investigation playbooks (kernel, MCP, AI-API, framework, SBOM, runtime, hardening, secrets, cred-stores, containers, crypto, plus `webhook-callback-abuse`, `cicd-pipeline-compromise`, `identity-sso-compromise`, `llm-tool-use-exfil`, `post-quantum-migration`, `ai-discovered-cve-triage`, `supply-chain-recovery`, `citation-hygiene`, `vc-wallet-trust`, `mail-server-hardening`, `network-trust`, `audit-log-integrity`, `self-update-integrity`, `multitenancy-isolation`, `decompression-dos`, `log-injection-telemetry`, `privacy-consent-ops`, and more), a CLI for discovery and investigation built around `discover → brief → run → attest` (each run executes the playbook's seven-phase contract), and a nightly auto-refresh job that pulls KEV / NVD / EPSS / GHSA / OSV / IETF deltas plus 15 primary-source advisory, research-blog, and tech-press feeds (Qualys TRU, Red Hat RHSA, Ubuntu USN, ZDI, kernel.org, oss-security, JFrog, CISA, Microsoft Security Blog, Sysdig, Trail of Bits, Embrace the Red, BleepingComputer security, and The Hacker News) into auto-PRs for editorial review, alongside a silent-regression watcher that flags historical CVEs re-broken without a new identifier.
34
34
 
35
35
  ---
36
36
 
package/data/_indexes/_meta.json CHANGED
@@ -1,22 +1,22 @@
1
1
  {
2
2
  "schema_version": "1.1.0",
3
- "generated_at": "2026-07-11T23:54:45.339Z",
3
+ "generated_at": "2026-07-23T02:32:24.239Z",
4
4
  "generator": "scripts/build-indexes.js",
5
5
  "source_count": 64,
6
6
  "source_hashes": {
7
- "manifest.json": "640ae4a66f3db19b0cb14761f45be4de1d432d0728f402cff45c1a4cb62807a7",
8
- "README.md": "91d223cb15dacbeb16642b2f4e0afcd41e086d33a10006a6d3b686f76ae32539",
7
+ "manifest.json": "6d1b779b2fe397bdcb7cd3381a0fa9526875845cdec8ee0cd9496480f2c13bb7",
8
+ "README.md": "71a9a2a74d6da9508da6c9b2027a17d5e60869d124cfbe194f094667766da14d",
9
9
  "data/atlas-ttps.json": "a414f3957956762a7f5aec07d36391b6579f45d1491b2a3db27eee38a4fad503",
10
- "data/attack-techniques.json": "8bfd00768b038f17601ad8cab9d4efee4bb5dd9319dc9924c6724be2fa37864c",
11
- "data/cve-catalog.json": "59e9b78bcc2f36e76ff9fad7fd3ca20feae799da8ff889e202db312c1c7b330b",
12
- "data/cwe-catalog.json": "0fe9c3d27daddaf1edf287ee7b8cbbdc004ab656e54abed41f8ddbe739df29eb",
10
+ "data/attack-techniques.json": "b9791cfae3465f95d8c59700b3fcf593e4a7a95e47bd28a18c10a782c4aa7ab7",
11
+ "data/cve-catalog.json": "c5545943732112ae69ef6d1381d76704e1621821a423bf4cd01b162a9afaae01",
12
+ "data/cwe-catalog.json": "307122227ce1dd5975e5c602de7a82d538b258cdf2f04b62092a72f7b96f6fb2",
13
13
  "data/d3fend-catalog.json": "b5c1e83d216ba8ece6be1368d807d1636f3d77622fd4e9148e9ba2f5fd44ee0d",
14
14
  "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
15
15
  "data/exploit-availability.json": "ec2656f0d9a893610e27b43eb6035fe9b18e057c9f6dfaac7e7d4959bbcbb795",
16
- "data/framework-control-gaps.json": "832547285529fdeb8110d39d471120cfee3053a8b2de3de1a9350715ef518732",
16
+ "data/framework-control-gaps.json": "c35e90008b2d99c20e33e341ea5440fc2a24bb10cdba9e709a1d34e069f94565",
17
17
  "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
18
18
  "data/rfc-references.json": "5db2f7006a1d7f2b8642a3e393213394e92798604576df973d0a0b8550f4b5ac",
19
- "data/zeroday-lessons.json": "96556be0a5fe8f4f72fb3924cc7caf6d8f801cbeb12b85816cf8b0e1af7e81e6",
19
+ "data/zeroday-lessons.json": "49ecd1aee2cfc5fe79a4ba0eb3c510d27427d773a5d56d15fef71b4b756b2ec1",
20
20
  "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
21
21
  "skills/ai-attack-surface/skill.md": "9a1fca96c27803506a9ebe98ffb1eb17206278b0aba39ecc5cd19d74f3a32fbf",
22
22
  "skills/mcp-agent-trust/skill.md": "fae25ffa7680b9ba66c86bb0aead7ea01f497c93ad9c1d04c6fdcdc42987b209",
@@ -101,8 +101,8 @@
101
101
  "dlp_refs": 0
102
102
  },
103
103
  "trigger_table_entries": 688,
104
- "chains_cve_entries": 606,
105
- "chains_cwe_entries": 199,
104
+ "chains_cve_entries": 806,
105
+ "chains_cwe_entries": 218,
106
106
  "jurisdictions_indexed": 34,
107
107
  "handoff_dag_nodes": 51,
108
108
  "summary_cards": 51,
package/data/_indexes/activity-feed.json CHANGED
@@ -6,20 +6,28 @@
6
6
  },
7
7
  "events": [
8
8
  {
9
- "date": "2026-07-03",
9
+ "date": "2026-07-18",
10
10
  "type": "catalog_update",
11
- "artifact": "data/atlas-ttps.json",
12
- "path": "data/atlas-ttps.json",
11
+ "artifact": "data/cve-catalog.json",
12
+ "path": "data/cve-catalog.json",
13
13
  "schema_version": "1.0.0",
14
- "entry_count": 170
14
+ "entry_count": 819
15
15
  },
16
16
  {
17
- "date": "2026-07-03",
17
+ "date": "2026-07-18",
18
18
  "type": "catalog_update",
19
19
  "artifact": "data/cwe-catalog.json",
20
20
  "path": "data/cwe-catalog.json",
21
21
  "schema_version": "1.0.0",
22
- "entry_count": 199
22
+ "entry_count": 218
23
+ },
24
+ {
25
+ "date": "2026-07-03",
26
+ "type": "catalog_update",
27
+ "artifact": "data/atlas-ttps.json",
28
+ "path": "data/atlas-ttps.json",
29
+ "schema_version": "1.0.0",
30
+ "entry_count": 170
23
31
  },
24
32
  {
25
33
  "date": "2026-07-03",
@@ -27,7 +35,7 @@
27
35
  "artifact": "data/zeroday-lessons.json",
28
36
  "path": "data/zeroday-lessons.json",
29
37
  "schema_version": "1.1.0",
30
- "entry_count": 619
38
+ "entry_count": 819
31
39
  },
32
40
  {
33
41
  "date": "2026-06-10",
@@ -324,14 +332,6 @@
324
332
  "path": "skills/privacy-consent-ops/skill.md",
325
333
  "note": "Privacy, consent, and sanctions operational integrity for mid-2026 — confusable/homoglyph normalization before sanctions screening, integrity-bound and re-validated consent records, evidence-gated and downstream-propagated DSR erasure, and ROPA reconciliation against actual processing"
326
334
  },
327
- {
328
- "date": "2026-06-01",
329
- "type": "catalog_update",
330
- "artifact": "data/cve-catalog.json",
331
- "path": "data/cve-catalog.json",
332
- "schema_version": "1.0.0",
333
- "entry_count": 619
334
- },
335
335
  {
336
336
  "date": "2026-05-27",
337
337
  "type": "catalog_update",
package/data/_indexes/catalog-summaries.json CHANGED
@@ -53,7 +53,7 @@
53
53
  "path": "data/cve-catalog.json",
54
54
  "purpose": "Per-CVE record (CVSS, EPSS, CISA KEV, RWEP, AI-discovery, vendor advisories, framework gaps, ATLAS/ATT&CK mappings). Cross-validated against NVD + CISA KEV + FIRST EPSS via validate-cves.",
55
55
  "schema_version": "1.0.0",
56
- "last_updated": "2026-06-01",
56
+ "last_updated": "2026-07-18",
57
57
  "tlp": "CLEAR",
58
58
  "source_confidence_default": "A1",
59
59
  "freshness_policy": {
@@ -62,20 +62,20 @@
62
62
  "rebuild_after_days": 365,
63
63
  "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
64
64
  },
65
- "entry_count": 619,
65
+ "entry_count": 819,
66
66
  "sample_keys": [
67
- "CVE-2026-56291",
68
- "CVE-2026-48939",
69
- "CVE-2026-56290",
70
- "CVE-2026-55255",
71
- "CVE-2026-48908"
67
+ "CVE-2024-27198",
68
+ "CVE-2024-23225",
69
+ "CVE-2024-23296",
70
+ "CVE-2023-21237",
71
+ "CVE-2021-36380"
72
72
  ]
73
73
  },
74
74
  "cwe-catalog.json": {
75
75
  "path": "data/cwe-catalog.json",
76
76
  "purpose": "MITRE CWE entries used by the project (subset with skill citations), with severity hint and category. Pinned to a CWE catalog version.",
77
77
  "schema_version": "1.0.0",
78
- "last_updated": "2026-07-03",
78
+ "last_updated": "2026-07-18",
79
79
  "tlp": "CLEAR",
80
80
  "source_confidence_default": "A1",
81
81
  "freshness_policy": {
@@ -84,7 +84,7 @@
84
84
  "rebuild_after_days": 365,
85
85
  "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
86
86
  },
87
- "entry_count": 199,
87
+ "entry_count": 218,
88
88
  "sample_keys": [
89
89
  "CWE-20",
90
90
  "CWE-22",
@@ -238,7 +238,7 @@
238
238
  "rebuild_after_days": 365,
239
239
  "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
240
240
  },
241
- "entry_count": 619,
241
+ "entry_count": 819,
242
242
  "sample_keys": [
243
243
  "CVE-2026-31431",
244
244
  "CVE-2025-53773",