@blamejs/exceptd-skills 0.19.25 → 0.19.26
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/AGENTS.md +15 -15
- package/ARCHITECTURE.md +7 -7
- package/CHANGELOG.md +16 -0
- package/CONTEXT.md +4 -4
- package/README.md +7 -7
- package/data/_indexes/_meta.json +10 -10
- package/data/_indexes/activity-feed.json +29 -29
- package/data/_indexes/catalog-summaries.json +13 -13
- package/data/_indexes/chains.json +76206 -0
- package/data/_indexes/frequency.json +1 -0
- package/data/attack-techniques.json +332 -14
- package/data/cve-catalog.json +11271 -4
- package/data/cwe-catalog.json +138 -4
- package/data/framework-control-gaps.json +767 -7
- package/data/zeroday-lessons.json +10075 -2
- package/lib/collectors/citation-hygiene.js +12 -0
- package/lib/cve-enrich.js +47 -3
- package/lib/refresh-external.js +119 -31
- package/manifest.json +53 -53
- package/package.json +2 -2
- package/sbom.cdx.json +41 -41
- package/scripts/check-epss-consistency.js +6 -10
package/sbom.cdx.json
CHANGED
|
@@ -1,23 +1,23 @@
|
|
|
1
1
|
{
|
|
2
2
|
"bomFormat": "CycloneDX",
|
|
3
3
|
"specVersion": "1.6",
|
|
4
|
-
"serialNumber": "urn:uuid:
|
|
4
|
+
"serialNumber": "urn:uuid:21151124-3b8c-4142-8fc3-20a23127b471",
|
|
5
5
|
"version": 1,
|
|
6
6
|
"metadata": {
|
|
7
|
-
"timestamp": "2026-08-
|
|
7
|
+
"timestamp": "2026-08-15T00:00:00.000Z",
|
|
8
8
|
"tools": [
|
|
9
9
|
{
|
|
10
10
|
"vendor": "blamejs",
|
|
11
11
|
"name": "scripts/refresh-sbom.js",
|
|
12
|
-
"version": "0.19.
|
|
12
|
+
"version": "0.19.26"
|
|
13
13
|
}
|
|
14
14
|
],
|
|
15
15
|
"component": {
|
|
16
|
-
"bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.19.
|
|
16
|
+
"bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.19.26",
|
|
17
17
|
"type": "application",
|
|
18
18
|
"name": "@blamejs/exceptd-skills",
|
|
19
|
-
"version": "0.19.
|
|
20
|
-
"description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (
|
|
19
|
+
"version": "0.19.26",
|
|
20
|
+
"description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (1125 CVEs / 233 CWEs / 794 ATT&CK + ICS / 174 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
|
|
21
21
|
"licenses": [
|
|
22
22
|
{
|
|
23
23
|
"license": {
|
|
@@ -25,17 +25,17 @@
|
|
|
25
25
|
}
|
|
26
26
|
}
|
|
27
27
|
],
|
|
28
|
-
"purl": "pkg:npm/%40blamejs/exceptd-skills@0.19.
|
|
28
|
+
"purl": "pkg:npm/%40blamejs/exceptd-skills@0.19.26",
|
|
29
29
|
"hashes": [
|
|
30
30
|
{
|
|
31
31
|
"alg": "SHA-256",
|
|
32
|
-
"content": "
|
|
32
|
+
"content": "c55d78bbe813adf4a440cc0a03add5613ab3203a6a2d0e327d2bec266179a2a1"
|
|
33
33
|
}
|
|
34
34
|
],
|
|
35
35
|
"externalReferences": [
|
|
36
36
|
{
|
|
37
37
|
"type": "distribution",
|
|
38
|
-
"url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.19.
|
|
38
|
+
"url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.19.26"
|
|
39
39
|
},
|
|
40
40
|
{
|
|
41
41
|
"type": "vcs",
|
|
@@ -94,11 +94,11 @@
|
|
|
94
94
|
"hashes": [
|
|
95
95
|
{
|
|
96
96
|
"alg": "SHA-256",
|
|
97
|
-
"content": "
|
|
97
|
+
"content": "77d13f8745a1ad9e7fe979efe343837b7a175c6a649c77237aedea1d45580a17"
|
|
98
98
|
},
|
|
99
99
|
{
|
|
100
100
|
"alg": "SHA3-512",
|
|
101
|
-
"content": "
|
|
101
|
+
"content": "9d294f4a6608f7f4dba60b8c3dc3978f105a556396a47da9bbc4efea99fef5312cfeb94e6bea0d3d66ae90316f5f6026ffb5248b63abcee53eef9510dea98f60"
|
|
102
102
|
}
|
|
103
103
|
]
|
|
104
104
|
},
|
|
@@ -109,11 +109,11 @@
|
|
|
109
109
|
"hashes": [
|
|
110
110
|
{
|
|
111
111
|
"alg": "SHA-256",
|
|
112
|
-
"content": "
|
|
112
|
+
"content": "20abf1205e3695183927a5673bcb0f34b79f33f107d3099fe3e529f56b4e515b"
|
|
113
113
|
},
|
|
114
114
|
{
|
|
115
115
|
"alg": "SHA3-512",
|
|
116
|
-
"content": "
|
|
116
|
+
"content": "778c3198046eb3c5e1dac27cef067640aa639a4358179e70c654fcf752fdb03f075f118c71e204f087483bad308aa101469a8e0eceb5af8fb9077f95174987fe"
|
|
117
117
|
}
|
|
118
118
|
]
|
|
119
119
|
},
|
|
@@ -124,11 +124,11 @@
|
|
|
124
124
|
"hashes": [
|
|
125
125
|
{
|
|
126
126
|
"alg": "SHA-256",
|
|
127
|
-
"content": "
|
|
127
|
+
"content": "704ecc7f543fa2d95aea84c36191528934cfa75c04294040d65e52cd600c1c92"
|
|
128
128
|
},
|
|
129
129
|
{
|
|
130
130
|
"alg": "SHA3-512",
|
|
131
|
-
"content": "
|
|
131
|
+
"content": "d2248b9f8ac5994c1f54eae9e15b452bad24dbc3494d134bfcb149cd3fd9925686ec426588966b19b243ced3431d27f827e36f61642e1570683b3cfd35c4234e"
|
|
132
132
|
}
|
|
133
133
|
]
|
|
134
134
|
},
|
|
@@ -139,11 +139,11 @@
|
|
|
139
139
|
"hashes": [
|
|
140
140
|
{
|
|
141
141
|
"alg": "SHA-256",
|
|
142
|
-
"content": "
|
|
142
|
+
"content": "6f69174c926f56bb338b87518bca57e8078f950530cddfca2b5effcd94154a70"
|
|
143
143
|
},
|
|
144
144
|
{
|
|
145
145
|
"alg": "SHA3-512",
|
|
146
|
-
"content": "
|
|
146
|
+
"content": "8b4ef2e6478dfb91d8d62a3a2611e900e061aa13b61ed1ee9f4229b37470fa9008329a237da84d8491f2875f628aa036010f491fe812d9ecf5bb407f8255927d"
|
|
147
147
|
}
|
|
148
148
|
]
|
|
149
149
|
},
|
|
@@ -184,11 +184,11 @@
|
|
|
184
184
|
"hashes": [
|
|
185
185
|
{
|
|
186
186
|
"alg": "SHA-256",
|
|
187
|
-
"content": "
|
|
187
|
+
"content": "0c1b4039f019d4f33f961ff4b5e115ae70dc45acfadab607ac7879d054654da3"
|
|
188
188
|
},
|
|
189
189
|
{
|
|
190
190
|
"alg": "SHA3-512",
|
|
191
|
-
"content": "
|
|
191
|
+
"content": "1f54d6eec1dbfcd32c0cab5d66884ef4eb398a104845a1ed17b59785c446e25fd84ba7d47e3baa459f5c7c6352dd9a5d708fe4cc11e80a4ac6a948457d311989"
|
|
192
192
|
}
|
|
193
193
|
]
|
|
194
194
|
},
|
|
@@ -319,11 +319,11 @@
|
|
|
319
319
|
"hashes": [
|
|
320
320
|
{
|
|
321
321
|
"alg": "SHA-256",
|
|
322
|
-
"content": "
|
|
322
|
+
"content": "81344e19dc49470631026a4a82c87ac17f5c2b6bdfd229e7bb5a7b0681e6fe3d"
|
|
323
323
|
},
|
|
324
324
|
{
|
|
325
325
|
"alg": "SHA3-512",
|
|
326
|
-
"content": "
|
|
326
|
+
"content": "774af2883d47a4833cef7c75841ebc72c0fe0be0688856b7d25179795f51eb0af26e604c5d29a8fef8939a072ff2756952b861a597e2e22a762ba15ae65590b5"
|
|
327
327
|
}
|
|
328
328
|
]
|
|
329
329
|
},
|
|
@@ -334,11 +334,11 @@
|
|
|
334
334
|
"hashes": [
|
|
335
335
|
{
|
|
336
336
|
"alg": "SHA-256",
|
|
337
|
-
"content": "
|
|
337
|
+
"content": "6d548f5e80d58f5d40c9f207ab67bfc63cf5df4eaf35667911a8a23dd518b3ee"
|
|
338
338
|
},
|
|
339
339
|
{
|
|
340
340
|
"alg": "SHA3-512",
|
|
341
|
-
"content": "
|
|
341
|
+
"content": "cd841484a11b9f6fa1733dca3b366408171a8b9821fc30d1d1d0b1c7872e6f1e1580c1f479b62efe17fdbbcc86410bdf0896dfae2ec1308955b11e44dffe7632"
|
|
342
342
|
}
|
|
343
343
|
]
|
|
344
344
|
},
|
|
@@ -349,11 +349,11 @@
|
|
|
349
349
|
"hashes": [
|
|
350
350
|
{
|
|
351
351
|
"alg": "SHA-256",
|
|
352
|
-
"content": "
|
|
352
|
+
"content": "eef5be77bd877af42ce848c9f320b702bc29fb9b085e3f4820523026e138c803"
|
|
353
353
|
},
|
|
354
354
|
{
|
|
355
355
|
"alg": "SHA3-512",
|
|
356
|
-
"content": "
|
|
356
|
+
"content": "047250c5cf6519886204275dba09a86ab8b181ada4153a714cfa0b123f8d27180c558e33bf167ebb07868bac7a144658ba9ecaff2a3c49804877d34a2db16e55"
|
|
357
357
|
}
|
|
358
358
|
]
|
|
359
359
|
},
|
|
@@ -409,11 +409,11 @@
|
|
|
409
409
|
"hashes": [
|
|
410
410
|
{
|
|
411
411
|
"alg": "SHA-256",
|
|
412
|
-
"content": "
|
|
412
|
+
"content": "0d3936786bf4f03a37b83e39b5eda4dc0186dbab6362735a04cb7e6f9b7dc069"
|
|
413
413
|
},
|
|
414
414
|
{
|
|
415
415
|
"alg": "SHA3-512",
|
|
416
|
-
"content": "
|
|
416
|
+
"content": "abd6d45d43bf55d63e93a288e5485521784ce5d04fc491d445d82b08944ba835519452ace9356aa7724d1325f95b4db87f78342f4910cc6b4fc727722bcf8d3b"
|
|
417
417
|
}
|
|
418
418
|
]
|
|
419
419
|
},
|
|
@@ -949,11 +949,11 @@
|
|
|
949
949
|
"hashes": [
|
|
950
950
|
{
|
|
951
951
|
"alg": "SHA-256",
|
|
952
|
-
"content": "
|
|
952
|
+
"content": "e13da4473fbfabb491b82efa690974a4238eadc977d29b045cf444961b53d448"
|
|
953
953
|
},
|
|
954
954
|
{
|
|
955
955
|
"alg": "SHA3-512",
|
|
956
|
-
"content": "
|
|
956
|
+
"content": "72f0a0e11b1b2b09856c102f8a1bafdef95f6605df1bb4283b9e87db9c652b715f68dd3a9b36846be3ba525dd8d612224b7b59202a7a95e3293fb3c37b26f12b"
|
|
957
957
|
}
|
|
958
958
|
]
|
|
959
959
|
},
|
|
@@ -1084,11 +1084,11 @@
|
|
|
1084
1084
|
"hashes": [
|
|
1085
1085
|
{
|
|
1086
1086
|
"alg": "SHA-256",
|
|
1087
|
-
"content": "
|
|
1087
|
+
"content": "1341426b158349e3443edcda7b6916b8ced15a5ce74fec2bbaf19df6675552d2"
|
|
1088
1088
|
},
|
|
1089
1089
|
{
|
|
1090
1090
|
"alg": "SHA3-512",
|
|
1091
|
-
"content": "
|
|
1091
|
+
"content": "28fb2a7e3709c619bfb352b104dc3ef6e8ed7b35cf180c4861704e41fcf61434adf8c2657cc47df834aec69011bc0089c5e105462f8336e3a626ca635cfb41cd"
|
|
1092
1092
|
}
|
|
1093
1093
|
]
|
|
1094
1094
|
},
|
|
@@ -1354,11 +1354,11 @@
|
|
|
1354
1354
|
"hashes": [
|
|
1355
1355
|
{
|
|
1356
1356
|
"alg": "SHA-256",
|
|
1357
|
-
"content": "
|
|
1357
|
+
"content": "8bc08d0ef9a0cc5b8db30440c75fbad152430c15a093ce03f22b6c1fac250cb2"
|
|
1358
1358
|
},
|
|
1359
1359
|
{
|
|
1360
1360
|
"alg": "SHA3-512",
|
|
1361
|
-
"content": "
|
|
1361
|
+
"content": "99ce1bc22f9c71439fe6340a714255ca00599e2d508e646b775d409a0edba24a43909200b5720c193607aacd83e61e9ec3d10f77c8f10a25dbd386b05304e0eb"
|
|
1362
1362
|
}
|
|
1363
1363
|
]
|
|
1364
1364
|
},
|
|
@@ -1549,11 +1549,11 @@
|
|
|
1549
1549
|
"hashes": [
|
|
1550
1550
|
{
|
|
1551
1551
|
"alg": "SHA-256",
|
|
1552
|
-
"content": "
|
|
1552
|
+
"content": "9a90f9a12c1af28b4274a1339b6808719d55f08fad7406ce1540164e6d935b0f"
|
|
1553
1553
|
},
|
|
1554
1554
|
{
|
|
1555
1555
|
"alg": "SHA3-512",
|
|
1556
|
-
"content": "
|
|
1556
|
+
"content": "2c15bf502d47eec8f69de7c1c63583ee072677dc3bb181af8d1496ebe2308d02144ba233fa911c492d896a0174561a2a8c45b925837257c03fea3c1c6e22b15a"
|
|
1557
1557
|
}
|
|
1558
1558
|
]
|
|
1559
1559
|
},
|
|
@@ -1954,11 +1954,11 @@
|
|
|
1954
1954
|
"hashes": [
|
|
1955
1955
|
{
|
|
1956
1956
|
"alg": "SHA-256",
|
|
1957
|
-
"content": "
|
|
1957
|
+
"content": "2947d3e8ee8467ee5ca2c01c6cf9bfd8ce9556a7c82da1d28a2dc32d1443e426"
|
|
1958
1958
|
},
|
|
1959
1959
|
{
|
|
1960
1960
|
"alg": "SHA3-512",
|
|
1961
|
-
"content": "
|
|
1961
|
+
"content": "fc9d6b5cd3a87f342a46a65429c7d2f352e4308bd5fe83c5b318555e3806a76496be8302461df67f3cfb0c255f56aca9d0970bbd8cff6d2698734a6583c4dde5"
|
|
1962
1962
|
}
|
|
1963
1963
|
]
|
|
1964
1964
|
},
|
|
@@ -2074,11 +2074,11 @@
|
|
|
2074
2074
|
"hashes": [
|
|
2075
2075
|
{
|
|
2076
2076
|
"alg": "SHA-256",
|
|
2077
|
-
"content": "
|
|
2077
|
+
"content": "8ed661d039cd3befcd3c9598f7ae5e878f6b4e4ebbea9678bc490fc35f2f0d93"
|
|
2078
2078
|
},
|
|
2079
2079
|
{
|
|
2080
2080
|
"alg": "SHA3-512",
|
|
2081
|
-
"content": "
|
|
2081
|
+
"content": "b41096de5c99adad911c3aab32da9a6fa9d9471e79554b77748486a93258b624418b68c773dc82943dae41af474e085706e384d50fdb59bfc244cbcc401f4d0a"
|
|
2082
2082
|
}
|
|
2083
2083
|
]
|
|
2084
2084
|
},
|
|
@@ -2449,11 +2449,11 @@
|
|
|
2449
2449
|
"hashes": [
|
|
2450
2450
|
{
|
|
2451
2451
|
"alg": "SHA-256",
|
|
2452
|
-
"content": "
|
|
2452
|
+
"content": "3d5b49b80e83ad4c1d20073dce35afa6b0c26f2a80c7d901e1ec14736808772a"
|
|
2453
2453
|
},
|
|
2454
2454
|
{
|
|
2455
2455
|
"alg": "SHA3-512",
|
|
2456
|
-
"content": "
|
|
2456
|
+
"content": "9cce527c0a18d140939ec34254939704d6436b173c2d3b53b371fdd7ec4e3db45ab082dae0628ca28f7c22a85941762671ffcf6c89564d786e66c2a2bb7602ee"
|
|
2457
2457
|
}
|
|
2458
2458
|
]
|
|
2459
2459
|
},
|
|
@@ -58,21 +58,17 @@ function loadCatalog(file) {
|
|
|
58
58
|
return JSON.parse(fs.readFileSync(file, "utf8"));
|
|
59
59
|
}
|
|
60
60
|
|
|
61
|
-
function ordinal(n) {
|
|
62
|
-
const suffixes = ["th", "st", "nd", "rd"];
|
|
63
|
-
const v = n % 100;
|
|
64
|
-
return `${n}${suffixes[(v - 20) % 10] || suffixes[v] || suffixes[0]}`;
|
|
65
|
-
}
|
|
66
|
-
|
|
67
61
|
/**
|
|
68
62
|
* The operator-readable restatement of an entry's EPSS fields. Entries carry it
|
|
69
63
|
* as `epss_note`, and it is derived, not authored — so it must be rebuilt
|
|
70
64
|
* whenever the numbers move.
|
|
65
|
+
*
|
|
66
|
+
* The renderer lives in lib/cve-enrich.js because the refresh writer rebuilds
|
|
67
|
+
* the note from the same definition. A second copy here would let the gate and
|
|
68
|
+
* the writer disagree about the exact wording, which shows up as this gate
|
|
69
|
+
* failing on data that was refreshed correctly.
|
|
71
70
|
*/
|
|
72
|
-
|
|
73
|
-
const pct = Math.round(entry.epss_percentile * 100);
|
|
74
|
-
return `FIRST EPSS ${entry.epss_score} (${ordinal(pct)} percentile) as of ${entry.epss_date}.`;
|
|
75
|
-
}
|
|
71
|
+
const { renderEpssNote: renderNote } = require("../lib/cve-enrich.js");
|
|
76
72
|
|
|
77
73
|
/**
|
|
78
74
|
* Group entries by publication date. Entries missing either field are reported
|