@blamejs/exceptd-skills 0.18.26 → 0.18.27

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (15) hide show
  1. package/CHANGELOG.md +4 -0
  2. package/README.md +1 -1
  3. package/data/_indexes/_meta.json +10 -10
  4. package/data/_indexes/activity-feed.json +11 -11
  5. package/data/_indexes/catalog-summaries.json +10 -10
  6. package/data/_indexes/chains.json +60141 -310
  7. package/data/_indexes/frequency.json +2 -0
  8. package/data/attack-techniques.json +209 -5
  9. package/data/cve-catalog.json +11157 -4
  10. package/data/cwe-catalog.json +174 -3
  11. package/data/framework-control-gaps.json +500 -0
  12. package/data/zeroday-lessons.json +6101 -1
  13. package/manifest.json +53 -53
  14. package/package.json +2 -2
  15. package/sbom.cdx.json +25 -25
package/CHANGELOG.md CHANGED
@@ -1,5 +1,9 @@
1
1
  # Changelog
2
2
 
3
+ ## 0.18.27 — 2026-07-30
4
+
5
+ CVE catalog currency: one hundred more CISA-KEV-listed, actively-exploited CVEs are now curated in the offline catalog (823 → 923), covering additions to the CISA Known Exploited Vulnerabilities catalog from March through August 2023 (plus four July 2026 additions) and spanning CVE publication years 2004 through 2026. Each entry carries a verified NVD CVSS vector and CWE, ATT&CK technique mappings, real-world exploitation status, primary-source indicators where public exploit code exists, global-first framework-control-gap declarations (NIST, EU NIS2/DORA, UK CAF, AU ISM/Essential 8, ISO 27001), an RWEP score, and a paired zero-day lesson. The batch centers on the 2023 mass-exploitation wave against file-transfer, email-security, and enterprise-edge infrastructure — the Progress MOVEit Transfer SQL-injection abused by Cl0p in the largest data-theft campaign of the year (CVE-2023-34362), the Barracuda Email Security Gateway command injection exploited by UNC4841 (CVE-2023-2868), the PaperCut MF/NG authentication-bypass RCE used by Cl0p and LockBit affiliates (CVE-2023-27350), the Adobe ColdFusion access-control and deserialization chain (CVE-2023-26359, CVE-2023-26360, CVE-2023-29298, CVE-2023-38205), the Ivanti EPMM/MobileIron authentication bypass and Sentry chain (CVE-2023-35078, CVE-2023-35081, CVE-2023-38035), the Citrix ShareFile storage-zones RCE (CVE-2023-24489), the Oracle WebLogic deserialization RCE (CVE-2023-21839), the Zyxel firewall command injection recruited into Mirai (CVE-2023-28771), and the VMware Aria/Tools flaws tied to UNC3886 (CVE-2023-20867, CVE-2023-20887). It also covers client and mobile exploitation heavily used by commercial-spyware and state actors — the Apple "Operation Triangulation" kernel flaw and the June-2023 iOS WebKit/kernel zero-day chain (CVE-2023-38606, CVE-2023-37450, CVE-2023-32409, CVE-2023-32434, CVE-2023-32435, CVE-2023-32439, CVE-2023-28204, CVE-2023-32373), the Microsoft Outlook NTLM-relay privilege escalation used by APT28/Forest Blizzard (CVE-2023-23397), the Microsoft Office RCE deployed by Storm-0978/RomCom (CVE-2023-36884) and the Windows SmartScreen bypass used by Magniber (CVE-2023-24880), the Samsung mobile-chipset chain surfaced in spyware exploitation (CVE-2021-25487, CVE-2021-25489, CVE-2021-25394, CVE-2021-25395, CVE-2021-25371, CVE-2021-25372), the Arm Mali GPU kernel driver flaws chained in Android spyware (CVE-2022-22706, CVE-2022-38181, CVE-2021-29256, CVE-2023-26083), and multiple Google Chrome V8 and Skia zero-days (CVE-2023-2033, CVE-2023-3079, CVE-2023-2136). A long tail of internet-facing devices recruited into botnets rounds out the set — TP-Link Archer (CVE-2023-1389), Ruckus wireless (CVE-2023-25717), D-Link routers (CVE-2019-17621, CVE-2019-20500), the end-of-life Zyxel P660HN (CVE-2017-18368), SolarView Compact (CVE-2022-29303) — alongside the Ignite Realtime Openfire path traversal mined by Kinsing (CVE-2023-32315), the Veeam Backup & Replication credential disclosure (CVE-2023-27532), the Samba "SambaCry" RCE (CVE-2017-7494), the Apache Log4j 2.15 follow-up (CVE-2021-45046), and older but still-exploited Linux privilege escalations and Cisco IOS flaws. Two weakness classes backing these entries are new to the CWE catalog: CWE-294 (authentication bypass by capture-replay, the mechanism behind the Outlook NTLM-relay flaw) and CWE-401 (missing release of memory after effective lifetime).
6
+
3
7
  ## 0.18.26 — 2026-07-22
4
8
 
5
9
  Every CVE in the offline catalog now declares a framework-control-gap statement for all five jurisdiction buckets — NIST, EU (NIS2/DORA), UK (CAF), AU (Essential 8/ISM), and ISO 27001:2022. Previously two-thirds of the catalog mapped only a subset, so operators subject to multiple regimes reading the framework-gap output got US- or EU-centric coverage on most entries. The remaining partial entries have been completed with vulnerability-specific gap statements — each tied to that CVE's own exploitation profile (exploitation window, attack vector, end-of-life status, blast radius) and resolving to a real control in the framework-control-gap catalog — bringing the whole catalog to full multi-jurisdiction coverage. A new predeploy gate enforces this, so a newly-curated CVE can no longer ship with a partial jurisdiction set.
package/README.md CHANGED
@@ -30,7 +30,7 @@ This platform surfaces what is actually happening right now. Every skill explici
30
30
 
31
31
  ## Status
32
32
 
33
- Pre-1.0. Latest release lives on [GitHub Releases](https://github.com/blamejs/exceptd-skills/releases) and on npm as [`@blamejs/exceptd-skills`](https://www.npmjs.com/package/@blamejs/exceptd-skills) with signed npm provenance attestation and Ed25519-signed skill bodies. The package ships 51 skills across kernel LPE, MCP supply chain, AI-as-C2, prompt injection, post-quantum crypto, SBOM integrity, identity-incident response, and 35 other AI/security domains, plus 11 intelligence catalogs (CVE / ATLAS / ATT&CK / CWE / D3FEND / DLP / RFC / framework gaps / global frameworks / zero-day lessons / exploit availability) covering 35 jurisdictions; the CVE catalog holds 819 actively-exploited and high-priority entries, each carrying behavioral indicators, an ATT&CK technique mapping, and a defense-chain zero-day lesson. 33 investigation playbooks (kernel, MCP, AI-API, framework, SBOM, runtime, hardening, secrets, cred-stores, containers, crypto, plus `webhook-callback-abuse`, `cicd-pipeline-compromise`, `identity-sso-compromise`, `llm-tool-use-exfil`, `post-quantum-migration`, `ai-discovered-cve-triage`, `supply-chain-recovery`, `citation-hygiene`, `vc-wallet-trust`, `mail-server-hardening`, `network-trust`, `audit-log-integrity`, `self-update-integrity`, `multitenancy-isolation`, `decompression-dos`, `log-injection-telemetry`, `privacy-consent-ops`, and more), a CLI for discovery and investigation built around `discover → brief → run → attest` (each run executes the playbook's seven-phase contract), and a nightly auto-refresh job that pulls KEV / NVD / EPSS / GHSA / OSV / IETF deltas plus 15 primary-source advisory, research-blog, and tech-press feeds (Qualys TRU, Red Hat RHSA, Ubuntu USN, ZDI, kernel.org, oss-security, JFrog, CISA, Microsoft Security Blog, Sysdig, Trail of Bits, Embrace the Red, BleepingComputer security, and The Hacker News) into auto-PRs for editorial review, alongside a silent-regression watcher that flags historical CVEs re-broken without a new identifier.
33
+ Pre-1.0. Latest release lives on [GitHub Releases](https://github.com/blamejs/exceptd-skills/releases) and on npm as [`@blamejs/exceptd-skills`](https://www.npmjs.com/package/@blamejs/exceptd-skills) with signed npm provenance attestation and Ed25519-signed skill bodies. The package ships 51 skills across kernel LPE, MCP supply chain, AI-as-C2, prompt injection, post-quantum crypto, SBOM integrity, identity-incident response, and 35 other AI/security domains, plus 11 intelligence catalogs (CVE / ATLAS / ATT&CK / CWE / D3FEND / DLP / RFC / framework gaps / global frameworks / zero-day lessons / exploit availability) covering 35 jurisdictions; the CVE catalog holds 923 actively-exploited and high-priority entries, each carrying behavioral indicators, an ATT&CK technique mapping, and a defense-chain zero-day lesson. 33 investigation playbooks (kernel, MCP, AI-API, framework, SBOM, runtime, hardening, secrets, cred-stores, containers, crypto, plus `webhook-callback-abuse`, `cicd-pipeline-compromise`, `identity-sso-compromise`, `llm-tool-use-exfil`, `post-quantum-migration`, `ai-discovered-cve-triage`, `supply-chain-recovery`, `citation-hygiene`, `vc-wallet-trust`, `mail-server-hardening`, `network-trust`, `audit-log-integrity`, `self-update-integrity`, `multitenancy-isolation`, `decompression-dos`, `log-injection-telemetry`, `privacy-consent-ops`, and more), a CLI for discovery and investigation built around `discover → brief → run → attest` (each run executes the playbook's seven-phase contract), and a nightly auto-refresh job that pulls KEV / NVD / EPSS / GHSA / OSV / IETF deltas plus 15 primary-source advisory, research-blog, and tech-press feeds (Qualys TRU, Red Hat RHSA, Ubuntu USN, ZDI, kernel.org, oss-security, JFrog, CISA, Microsoft Security Blog, Sysdig, Trail of Bits, Embrace the Red, BleepingComputer security, and The Hacker News) into auto-PRs for editorial review, alongside a silent-regression watcher that flags historical CVEs re-broken without a new identifier.
34
34
 
35
35
  ---
36
36
 
package/data/_indexes/_meta.json CHANGED
@@ -1,22 +1,22 @@
1
1
  {
2
2
  "schema_version": "1.1.0",
3
- "generated_at": "2026-07-23T13:14:46.671Z",
3
+ "generated_at": "2026-07-30T08:22:39.863Z",
4
4
  "generator": "scripts/build-indexes.js",
5
5
  "source_count": 64,
6
6
  "source_hashes": {
7
- "manifest.json": "4207cec11036cf109667a54673ac7de7aa7ef4110a3193a09c0879699c64369f",
8
- "README.md": "71a9a2a74d6da9508da6c9b2027a17d5e60869d124cfbe194f094667766da14d",
7
+ "manifest.json": "4d556e78e703a795b45d3cc85e53e00e5d017649804adac667df6dabb9636e93",
8
+ "README.md": "2d2f4ac4e7934e730fc88502b6f19c986c1a059dbae1eb3b5c3f672b9e0a4d7a",
9
9
  "data/atlas-ttps.json": "a414f3957956762a7f5aec07d36391b6579f45d1491b2a3db27eee38a4fad503",
10
- "data/attack-techniques.json": "15110923850a8873f41d4d85612a63736279389b9567b1446dd88b8398f73457",
11
- "data/cve-catalog.json": "662031d56c6ab7364328176339ae8f474c6312f288ca3d5154c8c31c7f5c86dd",
12
- "data/cwe-catalog.json": "7c91d37ee96dea56047a368c6ca86399ef2c3d92385019f94a3613a0c257e634",
10
+ "data/attack-techniques.json": "0f9d29c33502294e383da8c747d491ee972d1d6923695cecd110e8c9f6d53522",
11
+ "data/cve-catalog.json": "85afca7bff24a802ddd15b3b9f3b0951c35ab3232e79307718e6bad1d6f75c4c",
12
+ "data/cwe-catalog.json": "2075d9e36a95656817389ae5cc671ddc396ac532077a3b1c2eda20730c93c87d",
13
13
  "data/d3fend-catalog.json": "b5c1e83d216ba8ece6be1368d807d1636f3d77622fd4e9148e9ba2f5fd44ee0d",
14
14
  "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
15
15
  "data/exploit-availability.json": "ec2656f0d9a893610e27b43eb6035fe9b18e057c9f6dfaac7e7d4959bbcbb795",
16
- "data/framework-control-gaps.json": "f0bfc430eebdc5818179805f73b236fbbbc73763e5f11c4905aade9cacd41fd4",
16
+ "data/framework-control-gaps.json": "2490bffb1511f5157de8c8894267c509e6e8e27cd40e47df455f7550c06de866",
17
17
  "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
18
18
  "data/rfc-references.json": "5db2f7006a1d7f2b8642a3e393213394e92798604576df973d0a0b8550f4b5ac",
19
- "data/zeroday-lessons.json": "1712c3efebbe89e387105575be739ece9ac500a91b46fdd2b45c78f15ec5746b",
19
+ "data/zeroday-lessons.json": "5d293b1e2240dd40df948cb8fe40fd4637cda8d625a3b29d1d2731f36cbcbdf4",
20
20
  "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
21
21
  "skills/ai-attack-surface/skill.md": "9a1fca96c27803506a9ebe98ffb1eb17206278b0aba39ecc5cd19d74f3a32fbf",
22
22
  "skills/mcp-agent-trust/skill.md": "fae25ffa7680b9ba66c86bb0aead7ea01f497c93ad9c1d04c6fdcdc42987b209",
@@ -101,8 +101,8 @@
101
101
  "dlp_refs": 0
102
102
  },
103
103
  "trigger_table_entries": 688,
104
- "chains_cve_entries": 810,
105
- "chains_cwe_entries": 218,
104
+ "chains_cve_entries": 910,
105
+ "chains_cwe_entries": 220,
106
106
  "jurisdictions_indexed": 34,
107
107
  "handoff_dag_nodes": 51,
108
108
  "summary_cards": 51,
package/data/_indexes/activity-feed.json CHANGED
@@ -6,12 +6,20 @@
6
6
  },
7
7
  "events": [
8
8
  {
9
- "date": "2026-07-22",
9
+ "date": "2026-07-30",
10
10
  "type": "catalog_update",
11
11
  "artifact": "data/cve-catalog.json",
12
12
  "path": "data/cve-catalog.json",
13
13
  "schema_version": "1.0.0",
14
- "entry_count": 823
14
+ "entry_count": 923
15
+ },
16
+ {
17
+ "date": "2026-07-30",
18
+ "type": "catalog_update",
19
+ "artifact": "data/cwe-catalog.json",
20
+ "path": "data/cwe-catalog.json",
21
+ "schema_version": "1.0.0",
22
+ "entry_count": 220
15
23
  },
16
24
  {
17
25
  "date": "2026-07-22",
@@ -19,15 +27,7 @@
19
27
  "artifact": "data/zeroday-lessons.json",
20
28
  "path": "data/zeroday-lessons.json",
21
29
  "schema_version": "1.1.0",
22
- "entry_count": 823
23
- },
24
- {
25
- "date": "2026-07-18",
26
- "type": "catalog_update",
27
- "artifact": "data/cwe-catalog.json",
28
- "path": "data/cwe-catalog.json",
29
- "schema_version": "1.0.0",
30
- "entry_count": 218
30
+ "entry_count": 923
31
31
  },
32
32
  {
33
33
  "date": "2026-07-03",
package/data/_indexes/catalog-summaries.json CHANGED
@@ -53,7 +53,7 @@
53
53
  "path": "data/cve-catalog.json",
54
54
  "purpose": "Per-CVE record (CVSS, EPSS, CISA KEV, RWEP, AI-discovery, vendor advisories, framework gaps, ATLAS/ATT&CK mappings). Cross-validated against NVD + CISA KEV + FIRST EPSS via validate-cves.",
55
55
  "schema_version": "1.0.0",
56
- "last_updated": "2026-07-22",
56
+ "last_updated": "2026-07-30",
57
57
  "tlp": "CLEAR",
58
58
  "source_confidence_default": "A1",
59
59
  "freshness_policy": {
@@ -62,20 +62,20 @@
62
62
  "rebuild_after_days": 365,
63
63
  "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
64
64
  },
65
- "entry_count": 823,
65
+ "entry_count": 923,
66
66
  "sample_keys": [
67
- "CVE-2024-27198",
68
- "CVE-2024-23225",
69
- "CVE-2024-23296",
70
- "CVE-2023-21237",
71
- "CVE-2021-36380"
67
+ "CVE-2025-68686",
68
+ "CVE-2026-16812",
69
+ "CVE-2026-16232",
70
+ "CVE-2026-50522",
71
+ "CVE-2023-32315"
72
72
  ]
73
73
  },
74
74
  "cwe-catalog.json": {
75
75
  "path": "data/cwe-catalog.json",
76
76
  "purpose": "MITRE CWE entries used by the project (subset with skill citations), with severity hint and category. Pinned to a CWE catalog version.",
77
77
  "schema_version": "1.0.0",
78
- "last_updated": "2026-07-18",
78
+ "last_updated": "2026-07-30",
79
79
  "tlp": "CLEAR",
80
80
  "source_confidence_default": "A1",
81
81
  "freshness_policy": {
@@ -84,7 +84,7 @@
84
84
  "rebuild_after_days": 365,
85
85
  "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
86
86
  },
87
- "entry_count": 218,
87
+ "entry_count": 220,
88
88
  "sample_keys": [
89
89
  "CWE-20",
90
90
  "CWE-22",
@@ -238,7 +238,7 @@
238
238
  "rebuild_after_days": 365,
239
239
  "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
240
240
  },
241
- "entry_count": 823,
241
+ "entry_count": 923,
242
242
  "sample_keys": [
243
243
  "CVE-2026-31431",
244
244
  "CVE-2025-53773",