@blamejs/exceptd-skills 0.18.23 → 0.18.25

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (15) hide show
  1. package/CHANGELOG.md +8 -0
  2. package/README.md +1 -1
  3. package/data/_indexes/_meta.json +10 -10
  4. package/data/_indexes/activity-feed.json +11 -11
  5. package/data/_indexes/catalog-summaries.json +10 -10
  6. package/data/_indexes/chains.json +110629 -39555
  7. package/data/_indexes/frequency.json +5 -0
  8. package/data/attack-techniques.json +203 -2
  9. package/data/cve-catalog.json +9938 -63
  10. package/data/cwe-catalog.json +244 -1
  11. package/data/framework-control-gaps.json +610 -3
  12. package/data/zeroday-lessons.json +6091 -2
  13. package/manifest.json +53 -53
  14. package/package.json +2 -2
  15. package/sbom.cdx.json +25 -25
package/CHANGELOG.md CHANGED
@@ -1,5 +1,13 @@
1
1
  # Changelog
2
2
 
3
+ ## 0.18.25 — 2026-07-22
4
+
5
+ CVE catalog currency: four more CISA-KEV-listed, actively-exploited CVEs are now curated in the offline catalog (819 → 823), covering CISA Known Exploited Vulnerabilities catalog additions dated 2026-07-21. The set is the WordPress Core "wp2shell" pre-authentication remote-code-execution chain — CVE-2026-60137 (SQL injection in the WP_Query author__not_in parameter) plus CVE-2026-63030 (a REST batch-endpoint interpretation conflict that desynchronizes handler dispatch) — which reaches default installations of WordPress 6.9.x and 7.0.x and carries an accelerated three-day KEV deadline; CVE-2026-0770, an unauthenticated code-execution flaw in Langflow's /api/v1/validate/code endpoint (exec() over attacker-supplied Python), for which GitHub's advisory records no fixed release, so the effective control is removing endpoint exposure and network-isolating the service rather than patching; and CVE-2021-27137, a DD-WRT UPnP/SSDP stack buffer overflow patched in 2021 but newly weaponized in 2026 by the Gafgyt/C0XMO botnet to recruit routers as DDoS bots. Each entry carries a verified CVSS vector and CWE, ATT&CK technique mappings, real-world exploitation status, primary-source indicators, global-first framework-control-gap declarations across NIST, EU NIS2, UK CAF, AU Essential 8, and ISO 27001, an RWEP score, and a paired zero-day lesson.
6
+
7
+ ## 0.18.24 — 2026-07-21
8
+
9
+ CVE catalog currency: one hundred more CISA-KEV-listed, actively-exploited CVEs are now curated in the offline catalog (719 → 819), covering additions to the CISA Known Exploited Vulnerabilities catalog from August 2023 through March 2024 and spanning CVE publication years 2014 through 2024. Each entry carries a verified NVD CVSS vector and CWE, ATT&CK technique mappings, real-world exploitation status, primary-source indicators where public exploit code exists, global-first framework-control-gap declarations (NIST, EU NIS2/DORA, UK CAF, AU ISM/Essential 8, ISO 27001), an RWEP score, and a paired zero-day lesson. The batch is weighted toward internet-facing edge and enterprise infrastructure — the Citrix NetScaler "CitrixBleed" session-token disclosure mass-exploited by ransomware affiliates (CVE-2023-4966), the JetBrains TeamCity authentication bypass (CVE-2024-27198), the Atlassian Confluence broken-access-control and template-injection chain abused by Cerber ransomware (CVE-2023-22515, CVE-2023-22518, CVE-2023-22527), the Cisco IOS XE Web UI privilege-escalation-to-implant chain that compromised tens of thousands of devices (CVE-2023-20198, CVE-2023-20273), the F5 BIG-IP Configuration utility authentication-bypass-to-RCE pair (CVE-2023-46747, CVE-2023-46748), the SysAid path traversal used by Lace Tempest (CVE-2023-47246), the Ivanti EPMM/MobileIron authentication bypass (CVE-2023-35082), the Juniper Junos OS J-Web PHP external-variable-modification chain (CVE-2023-36844), and the Unitronics PLC insecure-default-credential flaw exploited against water utilities (CVE-2023-6448) — alongside client and mobile exploitation including the WinRAR file-name-spoofing code execution (CVE-2023-38831), the Windows SmartScreen and Internet Shortcut security-feature bypasses chained to deliver stealer and RAT payloads (CVE-2023-36025, CVE-2024-21412), the Apple "Operation Triangulation" zero-click WebKit and kernel chain (CVE-2023-41990, CVE-2023-42916, CVE-2023-42917), multiple Google Chrome/V8 zero-days (CVE-2023-4762, CVE-2023-6345, CVE-2024-0519), and the Microsoft Windows kernel privilege escalation used by Lazarus (CVE-2024-21338). Five weakness classes backing these entries are new to the CWE catalog: CWE-295 (improper certificate validation), CWE-351 (insufficient type distinction), CWE-473 (PHP external variable modification), CWE-703 (improper check or handling of exceptional conditions), and CWE-823 (use of out-of-range pointer offset).
10
+
3
11
  ## 0.18.23 — 2026-07-18
4
12
 
5
13
  CVE catalog currency: one hundred more CISA-KEV-listed, actively-exploited CVEs are now curated in the offline catalog (619 → 719), covering additions to the CISA Known Exploited Vulnerabilities catalog from March 2024 through July 2026 and spanning CVE publication years 2008 through 2026. Each entry carries a verified NVD CVSS vector and CWE, ATT&CK technique mappings, real-world exploitation status, primary-source indicators where public exploit code exists, global-first framework-control-gap declarations (NIST, EU NIS2/DORA, UK CAF, AU ISM/Essential 8, ISO 27001), an RWEP score, and a paired zero-day lesson. The batch is weighted toward internet-facing edge and enterprise infrastructure — the Palo Alto PAN-OS GlobalProtect command injection exploited as a zero-day (CVE-2024-3400), the PHP-CGI argument-injection RCE mass-exploited by TellYouThePass ransomware (CVE-2024-4577), a Linux kernel nf_tables use-after-free local privilege escalation (CVE-2024-1086), the Fortinet FortiClientEMS SQL-injection RCE (CVE-2023-48788), the Cisco ASA/FTD pair used in the ArcaneDoor campaign (CVE-2024-20353, CVE-2024-20359), the Check Point Security Gateway information disclosure (CVE-2024-24919), a VMware ESXi authentication bypass abused by ransomware affiliates (CVE-2024-37085), the OSGeo GeoServer evaluation RCE (CVE-2024-36401), the ServiceNow Now Platform input-validation RCE chain (CVE-2024-4879, CVE-2024-5217), and recent Microsoft SharePoint (CVE-2026-58644, CVE-2026-56164), Active Directory Federation Services (CVE-2026-56155), Oracle E-Business Suite (CVE-2026-46817), Fortinet FortiSandbox (CVE-2026-25089, CVE-2026-39808), and SonicWall SMA1000 (CVE-2026-15409, CVE-2026-15410) additions — alongside client and browser exploitation including six Google Chrome/V8 flaws (CVE-2024-4671, CVE-2024-4761, CVE-2024-4947, CVE-2024-5274, CVE-2024-7965, CVE-2024-7971), the Windows MSHTML spoofing flaw used by Void Banshee to deliver the Atlantida stealer (CVE-2024-43461), an Android Pixel firmware privilege escalation (CVE-2024-32896), and the Justice AV Solutions Viewer supply-chain backdoor (CVE-2024-4978). Fourteen weakness classes backing these entries are new to the CWE catalog: CWE-27, CWE-80, CWE-184, CWE-191, CWE-203, CWE-276, CWE-280, CWE-358, CWE-415, CWE-591, CWE-645, CWE-670, CWE-783, and CWE-1336.
package/README.md CHANGED
@@ -30,7 +30,7 @@ This platform surfaces what is actually happening right now. Every skill explici
30
30
 
31
31
  ## Status
32
32
 
33
- Pre-1.0. Latest release lives on [GitHub Releases](https://github.com/blamejs/exceptd-skills/releases) and on npm as [`@blamejs/exceptd-skills`](https://www.npmjs.com/package/@blamejs/exceptd-skills) with signed npm provenance attestation and Ed25519-signed skill bodies. The package ships 51 skills across kernel LPE, MCP supply chain, AI-as-C2, prompt injection, post-quantum crypto, SBOM integrity, identity-incident response, and 35 other AI/security domains, plus 11 intelligence catalogs (CVE / ATLAS / ATT&CK / CWE / D3FEND / DLP / RFC / framework gaps / global frameworks / zero-day lessons / exploit availability) covering 35 jurisdictions; the CVE catalog holds 519 actively-exploited and high-priority entries, each carrying behavioral indicators, an ATT&CK technique mapping, and a defense-chain zero-day lesson. 33 investigation playbooks (kernel, MCP, AI-API, framework, SBOM, runtime, hardening, secrets, cred-stores, containers, crypto, plus `webhook-callback-abuse`, `cicd-pipeline-compromise`, `identity-sso-compromise`, `llm-tool-use-exfil`, `post-quantum-migration`, `ai-discovered-cve-triage`, `supply-chain-recovery`, `citation-hygiene`, `vc-wallet-trust`, `mail-server-hardening`, `network-trust`, `audit-log-integrity`, `self-update-integrity`, `multitenancy-isolation`, `decompression-dos`, `log-injection-telemetry`, `privacy-consent-ops`, and more), a CLI for discovery and investigation built around `discover → brief → run → attest` (each run executes the playbook's seven-phase contract), and a nightly auto-refresh job that pulls KEV / NVD / EPSS / GHSA / OSV / IETF deltas plus 15 primary-source advisory, research-blog, and tech-press feeds (Qualys TRU, Red Hat RHSA, Ubuntu USN, ZDI, kernel.org, oss-security, JFrog, CISA, Microsoft Security Blog, Sysdig, Trail of Bits, Embrace the Red, BleepingComputer security, and The Hacker News) into auto-PRs for editorial review, alongside a silent-regression watcher that flags historical CVEs re-broken without a new identifier.
33
+ Pre-1.0. Latest release lives on [GitHub Releases](https://github.com/blamejs/exceptd-skills/releases) and on npm as [`@blamejs/exceptd-skills`](https://www.npmjs.com/package/@blamejs/exceptd-skills) with signed npm provenance attestation and Ed25519-signed skill bodies. The package ships 51 skills across kernel LPE, MCP supply chain, AI-as-C2, prompt injection, post-quantum crypto, SBOM integrity, identity-incident response, and 35 other AI/security domains, plus 11 intelligence catalogs (CVE / ATLAS / ATT&CK / CWE / D3FEND / DLP / RFC / framework gaps / global frameworks / zero-day lessons / exploit availability) covering 35 jurisdictions; the CVE catalog holds 819 actively-exploited and high-priority entries, each carrying behavioral indicators, an ATT&CK technique mapping, and a defense-chain zero-day lesson. 33 investigation playbooks (kernel, MCP, AI-API, framework, SBOM, runtime, hardening, secrets, cred-stores, containers, crypto, plus `webhook-callback-abuse`, `cicd-pipeline-compromise`, `identity-sso-compromise`, `llm-tool-use-exfil`, `post-quantum-migration`, `ai-discovered-cve-triage`, `supply-chain-recovery`, `citation-hygiene`, `vc-wallet-trust`, `mail-server-hardening`, `network-trust`, `audit-log-integrity`, `self-update-integrity`, `multitenancy-isolation`, `decompression-dos`, `log-injection-telemetry`, `privacy-consent-ops`, and more), a CLI for discovery and investigation built around `discover → brief → run → attest` (each run executes the playbook's seven-phase contract), and a nightly auto-refresh job that pulls KEV / NVD / EPSS / GHSA / OSV / IETF deltas plus 15 primary-source advisory, research-blog, and tech-press feeds (Qualys TRU, Red Hat RHSA, Ubuntu USN, ZDI, kernel.org, oss-security, JFrog, CISA, Microsoft Security Blog, Sysdig, Trail of Bits, Embrace the Red, BleepingComputer security, and The Hacker News) into auto-PRs for editorial review, alongside a silent-regression watcher that flags historical CVEs re-broken without a new identifier.
34
34
 
35
35
  ---
36
36
 
package/data/_indexes/_meta.json CHANGED
@@ -1,22 +1,22 @@
1
1
  {
2
2
  "schema_version": "1.1.0",
3
- "generated_at": "2026-07-18T08:08:40.009Z",
3
+ "generated_at": "2026-07-23T04:30:27.503Z",
4
4
  "generator": "scripts/build-indexes.js",
5
5
  "source_count": 64,
6
6
  "source_hashes": {
7
- "manifest.json": "6c40bb0b1c80d38a2756501524b074e0885bf99d234ecdc4c66176bd232ee699",
8
- "README.md": "91d223cb15dacbeb16642b2f4e0afcd41e086d33a10006a6d3b686f76ae32539",
7
+ "manifest.json": "ff620f4315eb55c04983b4a6426bbedc2b3ed152ab033b412c475ab16666f410",
8
+ "README.md": "71a9a2a74d6da9508da6c9b2027a17d5e60869d124cfbe194f094667766da14d",
9
9
  "data/atlas-ttps.json": "a414f3957956762a7f5aec07d36391b6579f45d1491b2a3db27eee38a4fad503",
10
- "data/attack-techniques.json": "14fd17a88f5ddbd37dae6cface6114f95e4c6d8409f0cf8ce050a5369b88568d",
11
- "data/cve-catalog.json": "f5d27d4ff1452fd0f40e45c9aaecae16a0910fb12b695e9353a6090d9d11608e",
12
- "data/cwe-catalog.json": "ed975d2500ea655b89007cee5de3afac0f5cd5720d3175a92a4382ddd8774ff7",
10
+ "data/attack-techniques.json": "15110923850a8873f41d4d85612a63736279389b9567b1446dd88b8398f73457",
11
+ "data/cve-catalog.json": "d2380ef0293cd71331766955e2d9d5bd630bb106160de242ad23c004a2b678f7",
12
+ "data/cwe-catalog.json": "7c91d37ee96dea56047a368c6ca86399ef2c3d92385019f94a3613a0c257e634",
13
13
  "data/d3fend-catalog.json": "b5c1e83d216ba8ece6be1368d807d1636f3d77622fd4e9148e9ba2f5fd44ee0d",
14
14
  "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
15
15
  "data/exploit-availability.json": "ec2656f0d9a893610e27b43eb6035fe9b18e057c9f6dfaac7e7d4959bbcbb795",
16
- "data/framework-control-gaps.json": "87a3ef8628ec7e1339a25ac047cf0c7cdaa82bd6d3db9e8257141d9656a9bd33",
16
+ "data/framework-control-gaps.json": "a4f8e629f7a94dd38def59b6adca6fc59726671cba6662a033e576bd70316b33",
17
17
  "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
18
18
  "data/rfc-references.json": "5db2f7006a1d7f2b8642a3e393213394e92798604576df973d0a0b8550f4b5ac",
19
- "data/zeroday-lessons.json": "bf2ef195d95d795c08e42b1ff3a214e4a637b108309afc69977d15f25dab10f6",
19
+ "data/zeroday-lessons.json": "1712c3efebbe89e387105575be739ece9ac500a91b46fdd2b45c78f15ec5746b",
20
20
  "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
21
21
  "skills/ai-attack-surface/skill.md": "9a1fca96c27803506a9ebe98ffb1eb17206278b0aba39ecc5cd19d74f3a32fbf",
22
22
  "skills/mcp-agent-trust/skill.md": "fae25ffa7680b9ba66c86bb0aead7ea01f497c93ad9c1d04c6fdcdc42987b209",
@@ -101,8 +101,8 @@
101
101
  "dlp_refs": 0
102
102
  },
103
103
  "trigger_table_entries": 688,
104
- "chains_cve_entries": 706,
105
- "chains_cwe_entries": 213,
104
+ "chains_cve_entries": 810,
105
+ "chains_cwe_entries": 218,
106
106
  "jurisdictions_indexed": 34,
107
107
  "handoff_dag_nodes": 51,
108
108
  "summary_cards": 51,
package/data/_indexes/activity-feed.json CHANGED
@@ -6,12 +6,20 @@
6
6
  },
7
7
  "events": [
8
8
  {
9
- "date": "2026-07-18",
9
+ "date": "2026-07-22",
10
10
  "type": "catalog_update",
11
11
  "artifact": "data/cve-catalog.json",
12
12
  "path": "data/cve-catalog.json",
13
13
  "schema_version": "1.0.0",
14
- "entry_count": 719
14
+ "entry_count": 823
15
+ },
16
+ {
17
+ "date": "2026-07-22",
18
+ "type": "catalog_update",
19
+ "artifact": "data/zeroday-lessons.json",
20
+ "path": "data/zeroday-lessons.json",
21
+ "schema_version": "1.1.0",
22
+ "entry_count": 823
15
23
  },
16
24
  {
17
25
  "date": "2026-07-18",
@@ -19,7 +27,7 @@
19
27
  "artifact": "data/cwe-catalog.json",
20
28
  "path": "data/cwe-catalog.json",
21
29
  "schema_version": "1.0.0",
22
- "entry_count": 213
30
+ "entry_count": 218
23
31
  },
24
32
  {
25
33
  "date": "2026-07-03",
@@ -29,14 +37,6 @@
29
37
  "schema_version": "1.0.0",
30
38
  "entry_count": 170
31
39
  },
32
- {
33
- "date": "2026-07-03",
34
- "type": "catalog_update",
35
- "artifact": "data/zeroday-lessons.json",
36
- "path": "data/zeroday-lessons.json",
37
- "schema_version": "1.1.0",
38
- "entry_count": 719
39
- },
40
40
  {
41
41
  "date": "2026-06-10",
42
42
  "type": "skill_review",
package/data/_indexes/catalog-summaries.json CHANGED
@@ -53,7 +53,7 @@
53
53
  "path": "data/cve-catalog.json",
54
54
  "purpose": "Per-CVE record (CVSS, EPSS, CISA KEV, RWEP, AI-discovery, vendor advisories, framework gaps, ATLAS/ATT&CK mappings). Cross-validated against NVD + CISA KEV + FIRST EPSS via validate-cves.",
55
55
  "schema_version": "1.0.0",
56
- "last_updated": "2026-07-18",
56
+ "last_updated": "2026-07-22",
57
57
  "tlp": "CLEAR",
58
58
  "source_confidence_default": "A1",
59
59
  "freshness_policy": {
@@ -62,13 +62,13 @@
62
62
  "rebuild_after_days": 365,
63
63
  "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
64
64
  },
65
- "entry_count": 719,
65
+ "entry_count": 823,
66
66
  "sample_keys": [
67
- "CVE-2026-58644",
68
- "CVE-2026-25089",
69
- "CVE-2026-39808",
70
- "CVE-2026-46817",
71
- "CVE-2023-4346"
67
+ "CVE-2024-27198",
68
+ "CVE-2024-23225",
69
+ "CVE-2024-23296",
70
+ "CVE-2023-21237",
71
+ "CVE-2021-36380"
72
72
  ]
73
73
  },
74
74
  "cwe-catalog.json": {
@@ -84,7 +84,7 @@
84
84
  "rebuild_after_days": 365,
85
85
  "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
86
86
  },
87
- "entry_count": 213,
87
+ "entry_count": 218,
88
88
  "sample_keys": [
89
89
  "CWE-20",
90
90
  "CWE-22",
@@ -229,7 +229,7 @@
229
229
  "path": "data/zeroday-lessons.json",
230
230
  "purpose": "Distilled lessons from notable zero-days and campaigns (SesameOp, Copy Fail, Dirty Frag, Copilot RCE, Windsurf MCP). Each entry: technique, distinguishing characteristic, what it means for the framework lag.",
231
231
  "schema_version": "1.1.0",
232
- "last_updated": "2026-07-03",
232
+ "last_updated": "2026-07-22",
233
233
  "tlp": "CLEAR",
234
234
  "source_confidence_default": "B2",
235
235
  "freshness_policy": {
@@ -238,7 +238,7 @@
238
238
  "rebuild_after_days": 365,
239
239
  "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
240
240
  },
241
- "entry_count": 719,
241
+ "entry_count": 823,
242
242
  "sample_keys": [
243
243
  "CVE-2026-31431",
244
244
  "CVE-2025-53773",