@blamejs/exceptd-skills 0.19.36 → 0.19.38
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +18 -0
- package/data/_indexes/_meta.json +9 -9
- package/data/_indexes/activity-feed.json +2 -2
- package/data/_indexes/catalog-summaries.json +7 -7
- package/data/_indexes/chains.json +64478 -0
- package/data/atlas-ttps.json +11 -3
- package/data/attack-techniques.json +443 -39
- package/data/cve-catalog.json +11666 -2
- package/data/cwe-catalog.json +120 -11
- package/data/framework-control-gaps.json +521 -7
- package/data/zeroday-lessons.json +9215 -2
- package/manifest.json +53 -53
- package/package.json +2 -2
- package/sbom.cdx.json +29 -29
- package/scripts/check-catalog-gap-budget.js +9 -1
package/sbom.cdx.json
CHANGED
|
@@ -1,23 +1,23 @@
|
|
|
1
1
|
{
|
|
2
2
|
"bomFormat": "CycloneDX",
|
|
3
3
|
"specVersion": "1.6",
|
|
4
|
-
"serialNumber": "urn:uuid:
|
|
4
|
+
"serialNumber": "urn:uuid:789f55ba-ce23-45ea-9b3c-cac95a0b358e",
|
|
5
5
|
"version": 1,
|
|
6
6
|
"metadata": {
|
|
7
|
-
"timestamp": "2026-08-
|
|
7
|
+
"timestamp": "2026-08-30T00:00:00.000Z",
|
|
8
8
|
"tools": [
|
|
9
9
|
{
|
|
10
10
|
"vendor": "blamejs",
|
|
11
11
|
"name": "scripts/refresh-sbom.js",
|
|
12
|
-
"version": "0.19.
|
|
12
|
+
"version": "0.19.38"
|
|
13
13
|
}
|
|
14
14
|
],
|
|
15
15
|
"component": {
|
|
16
|
-
"bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.19.
|
|
16
|
+
"bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.19.38",
|
|
17
17
|
"type": "application",
|
|
18
18
|
"name": "@blamejs/exceptd-skills",
|
|
19
|
-
"version": "0.19.
|
|
20
|
-
"description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (
|
|
19
|
+
"version": "0.19.38",
|
|
20
|
+
"description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (1517 CVEs / 236 CWEs / 794 ATT&CK + ICS / 174 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
|
|
21
21
|
"licenses": [
|
|
22
22
|
{
|
|
23
23
|
"license": {
|
|
@@ -25,17 +25,17 @@
|
|
|
25
25
|
}
|
|
26
26
|
}
|
|
27
27
|
],
|
|
28
|
-
"purl": "pkg:npm/%40blamejs/exceptd-skills@0.19.
|
|
28
|
+
"purl": "pkg:npm/%40blamejs/exceptd-skills@0.19.38",
|
|
29
29
|
"hashes": [
|
|
30
30
|
{
|
|
31
31
|
"alg": "SHA-256",
|
|
32
|
-
"content": "
|
|
32
|
+
"content": "e6109a4bf0fc4b5707a510973b0d50d20b14c0b1c33677b648711c90bbba5011"
|
|
33
33
|
}
|
|
34
34
|
],
|
|
35
35
|
"externalReferences": [
|
|
36
36
|
{
|
|
37
37
|
"type": "distribution",
|
|
38
|
-
"url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.19.
|
|
38
|
+
"url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.19.38"
|
|
39
39
|
},
|
|
40
40
|
{
|
|
41
41
|
"type": "vcs",
|
|
@@ -124,11 +124,11 @@
|
|
|
124
124
|
"hashes": [
|
|
125
125
|
{
|
|
126
126
|
"alg": "SHA-256",
|
|
127
|
-
"content": "
|
|
127
|
+
"content": "f299dcf2686ef0c8db9a5d6e16dad140dac95a34dce2757c2ba7bb3563261d80"
|
|
128
128
|
},
|
|
129
129
|
{
|
|
130
130
|
"alg": "SHA3-512",
|
|
131
|
-
"content": "
|
|
131
|
+
"content": "86e32cded3d8f94600601700c9c0755ec9bf1f087dc9c267bd8100927bc362cd055e75be2a49bbf37841dbb6095f470155fc31c528725cfdfc4bded6619839f7"
|
|
132
132
|
}
|
|
133
133
|
]
|
|
134
134
|
},
|
|
@@ -304,11 +304,11 @@
|
|
|
304
304
|
"hashes": [
|
|
305
305
|
{
|
|
306
306
|
"alg": "SHA-256",
|
|
307
|
-
"content": "
|
|
307
|
+
"content": "09c4fa9bfedca16747f56a05ae296c820c1e99f5643f9da59e6871014ac057d1"
|
|
308
308
|
},
|
|
309
309
|
{
|
|
310
310
|
"alg": "SHA3-512",
|
|
311
|
-
"content": "
|
|
311
|
+
"content": "361d3b4a35e81e774a5863b20d41721bd119177119e8bae036f9f17672bf4001dbfecd6a626b7ba662ea8688d585e348cebc8c072bd21a6d99c02780ebd00697"
|
|
312
312
|
}
|
|
313
313
|
]
|
|
314
314
|
},
|
|
@@ -319,11 +319,11 @@
|
|
|
319
319
|
"hashes": [
|
|
320
320
|
{
|
|
321
321
|
"alg": "SHA-256",
|
|
322
|
-
"content": "
|
|
322
|
+
"content": "00312ce7b17c9df7cdc94f1aaf668fc9e891c25f9b14c650707f65c11e6677d7"
|
|
323
323
|
},
|
|
324
324
|
{
|
|
325
325
|
"alg": "SHA3-512",
|
|
326
|
-
"content": "
|
|
326
|
+
"content": "c6759327c48ea2a6342917bf4bd4262022f9846490b41bf059bc946db71121fa2b396295683116fe7845e75749b1174cf6bb7745517e4d02411a69dcb9a32981"
|
|
327
327
|
}
|
|
328
328
|
]
|
|
329
329
|
},
|
|
@@ -334,11 +334,11 @@
|
|
|
334
334
|
"hashes": [
|
|
335
335
|
{
|
|
336
336
|
"alg": "SHA-256",
|
|
337
|
-
"content": "
|
|
337
|
+
"content": "cd55cc402d63ef8b29402412c6399d9c07647d206903dc667a79c35f33303ff4"
|
|
338
338
|
},
|
|
339
339
|
{
|
|
340
340
|
"alg": "SHA3-512",
|
|
341
|
-
"content": "
|
|
341
|
+
"content": "3b95adb5fb218230073a2e0e2c451cd80a6d6d37dba0c5874fc2791b608bb48b407dd54d4846bc5542c9eda7c82a2c51a6fd2eb3c0a109597f9fe33f0f3ec32b"
|
|
342
342
|
}
|
|
343
343
|
]
|
|
344
344
|
},
|
|
@@ -349,11 +349,11 @@
|
|
|
349
349
|
"hashes": [
|
|
350
350
|
{
|
|
351
351
|
"alg": "SHA-256",
|
|
352
|
-
"content": "
|
|
352
|
+
"content": "e8d9741fae3938a7cc078832f9c5fba8e864809c6b6eb998fd8ba0a6fcd69ad4"
|
|
353
353
|
},
|
|
354
354
|
{
|
|
355
355
|
"alg": "SHA3-512",
|
|
356
|
-
"content": "
|
|
356
|
+
"content": "5d1d1f269928cb00827da0e46929d7eaa0946c120eeb1c6aa0687406f62aa212e663e12783707f2a6ce13c952a77e29903d917abe1e73ec987560153be54da66"
|
|
357
357
|
}
|
|
358
358
|
]
|
|
359
359
|
},
|
|
@@ -409,11 +409,11 @@
|
|
|
409
409
|
"hashes": [
|
|
410
410
|
{
|
|
411
411
|
"alg": "SHA-256",
|
|
412
|
-
"content": "
|
|
412
|
+
"content": "a5c8378d53886252cfcfd319de46c4ceadce2e3511f810d2e9dbf94cf6b252f7"
|
|
413
413
|
},
|
|
414
414
|
{
|
|
415
415
|
"alg": "SHA3-512",
|
|
416
|
-
"content": "
|
|
416
|
+
"content": "1f3e3d7cdf66b9ff22658ee445b91fe66a6239223179d22e98049e82d22fd509730a01ef67e846bbfbb37fb9790f4f2136b35307fc2ce0f6277bcfb50cbd0434"
|
|
417
417
|
}
|
|
418
418
|
]
|
|
419
419
|
},
|
|
@@ -949,11 +949,11 @@
|
|
|
949
949
|
"hashes": [
|
|
950
950
|
{
|
|
951
951
|
"alg": "SHA-256",
|
|
952
|
-
"content": "
|
|
952
|
+
"content": "2ecddeaaea1f5883132e009a168046eb88807cddde14310410b31df43cda42b4"
|
|
953
953
|
},
|
|
954
954
|
{
|
|
955
955
|
"alg": "SHA3-512",
|
|
956
|
-
"content": "
|
|
956
|
+
"content": "47b61c3145e05a82870b3475c08cb939c5da7e1ce5d6818698546fc611cd21cc759a2937fbd630a98264f2a9edacd26fbbd2e09a7806631c9a92c7b2a8311099"
|
|
957
957
|
}
|
|
958
958
|
]
|
|
959
959
|
},
|
|
@@ -1954,11 +1954,11 @@
|
|
|
1954
1954
|
"hashes": [
|
|
1955
1955
|
{
|
|
1956
1956
|
"alg": "SHA-256",
|
|
1957
|
-
"content": "
|
|
1957
|
+
"content": "b1bbfd14feb5f0dc0cc4afa5cf7100c6832a92ede0fb703ff769d327a4a63b1b"
|
|
1958
1958
|
},
|
|
1959
1959
|
{
|
|
1960
1960
|
"alg": "SHA3-512",
|
|
1961
|
-
"content": "
|
|
1961
|
+
"content": "842b9586929732a4c6bd2d4479fdb896252c6462b026ecd7c9e75063c8b97ad0c89cc30e08ca4b315057f30efacbf58402836fd192904b0fa3e40972d5f6ef06"
|
|
1962
1962
|
}
|
|
1963
1963
|
]
|
|
1964
1964
|
},
|
|
@@ -2074,11 +2074,11 @@
|
|
|
2074
2074
|
"hashes": [
|
|
2075
2075
|
{
|
|
2076
2076
|
"alg": "SHA-256",
|
|
2077
|
-
"content": "
|
|
2077
|
+
"content": "4704b43f937ee8a5c6ae35100a6eeefa4f094f3fd5f75bb91b56a84149f969a4"
|
|
2078
2078
|
},
|
|
2079
2079
|
{
|
|
2080
2080
|
"alg": "SHA3-512",
|
|
2081
|
-
"content": "
|
|
2081
|
+
"content": "d17f4b841678500afa470c71f4ad017a80ce57dd37ca413fa7fe585b53b80c20a58c2d6f30e656f8de1fd88d194e71bacda5c60d7e34f22d16ad343accc807fa"
|
|
2082
2082
|
}
|
|
2083
2083
|
]
|
|
2084
2084
|
},
|
|
@@ -2389,11 +2389,11 @@
|
|
|
2389
2389
|
"hashes": [
|
|
2390
2390
|
{
|
|
2391
2391
|
"alg": "SHA-256",
|
|
2392
|
-
"content": "
|
|
2392
|
+
"content": "7aac721a4eed02407f292f062e577707617221f2d33f7e1656224d49dd614f36"
|
|
2393
2393
|
},
|
|
2394
2394
|
{
|
|
2395
2395
|
"alg": "SHA3-512",
|
|
2396
|
-
"content": "
|
|
2396
|
+
"content": "18dab395326c1c62cc2e0653fba111c584211f044224b8af444cc9cc1861308f7cb2ed9c04e852ac764007d435e3752dee181ee46bdcb15fcc97d9705a6a1a68"
|
|
2397
2397
|
}
|
|
2398
2398
|
]
|
|
2399
2399
|
},
|
|
@@ -40,7 +40,15 @@ function loadAll() {
|
|
|
40
40
|
// Per-class regression budgets, mirrored in
|
|
41
41
|
// tests/shipped-catalog-integrity.test.js.
|
|
42
42
|
const BUDGET = {
|
|
43
|
-
|
|
43
|
+
// Five KEV-listed entries whose vendors published no advisory at all. Each
|
|
44
|
+
// absence is control-tested rather than assumed: the Nagios XI changelog
|
|
45
|
+
// names sibling CVE-2021-25299 and none of -25296/-25297/-25298, so the
|
|
46
|
+
// search that finds nothing for those three is working. WinRAR's only vendor
|
|
47
|
+
// reference is a rolling release-notes page that no longer mentions the
|
|
48
|
+
// defect, and Grandstream's advisory paths 404. An entry cannot cite an
|
|
49
|
+
// advisory that does not exist, and inventing a plausible URL would send an
|
|
50
|
+
// operator somewhere authoritative-looking and wrong.
|
|
51
|
+
"content-quality": 14,
|
|
44
52
|
// temporal-staleness counts only the maintainer-controllable freshness fields,
|
|
45
53
|
// which sit at 0 on fresh data; the headroom covers entries aging past a
|
|
46
54
|
// threshold between refreshes.
|