@blamejs/exceptd-skills 0.19.6 → 0.19.8

package/AGENTS.md

@@ -222,8 +222,10 @@ Recently added (use the IDs in skill prose and operator briefings; full text in
 
 | ID | Name | Surfacing zero-day | Coverage gap closed |
 |---|---|---|---|
-| `NEW-CTRL-048` | NPM-MAINTAINER-MFA-ENFORCEMENT / KERNEL-EXIT-RACE-CVE-CLASS-MONITORING | `MAL-2026-NODE-IPC-STEALER`, `CVE-2026-46333` | NIST-800-218 SSDF, NIST-800-53 IA-5/AU-2/SI-4, NIS2 Art.21 supply-chain |
-| `NEW-CTRL-049` | LOCKFILE-INTEGRITY-VERIFIED-AT-CI-BOOT / SUID-MINIMIZATION-FOR-KERNEL-LPE-CARRIER-BINARIES | `MAL-2026-NODE-IPC-STEALER`, `CVE-2026-46333` | NIST-800-218 SSDF, EU CRA Art.13, SLSA Build L3, NIST-800-53 CM-6/AC-3 |
+| `NEW-CTRL-048` | NPM-MAINTAINER-MFA-ENFORCEMENT | `MAL-2026-NODE-IPC-STEALER` | NIST-800-218 SSDF, NIST-800-53 IA-5, NIS2 Art.21 supply-chain |
+| `NEW-CTRL-049` | LOCKFILE-INTEGRITY-VERIFIED-AT-CI-BOOT | `MAL-2026-NODE-IPC-STEALER` | NIST-800-218 SSDF, EU CRA Art.13, SLSA Build L3 |
+| `NEW-CTRL-141` | KERNEL-EXIT-RACE-CVE-CLASS-MONITORING | `CVE-2026-46333` | NIST-800-53 AU-2/SI-4 |
+| `NEW-CTRL-142` | SUID-MINIMIZATION-FOR-KERNEL-LPE-CARRIER-BINARIES | `CVE-2026-46333` | NIST-800-53 CM-6/AC-3 |
 | `NEW-CTRL-050` | AI-ASSISTANT-CONFIG-FILE-PERMISSION-LOCKDOWN | `MAL-2026-SHAI-HULUD-OSS` | NIST-800-53 AC-3/CM-6. Enforced operationally by `exceptd doctor --ai-config`. |
 | `NEW-CTRL-051` | NPM-PUBLISH-TOKEN-WORKSTATION-ISOLATION | `MAL-2026-SHAI-HULUD-OSS` | NIST-800-53 IA-5, NIST-800-218 SSDF PW.4 |
 | `NEW-CTRL-052` | GITHUB-REPO-PATTERN-MONITORING-FOR-EXFIL-CHANNELS | `MAL-2026-SHAI-HULUD-OSS` | NIST-800-53 SI-4. Enforced operationally by `exceptd watchlist --org-scan`. |
@@ -247,7 +249,7 @@ Recently added (use the IDs in skill prose and operator briefings; full text in
 | `NEW-CTRL-070` | TYPOSQUAT-INSTALL-TIME-NAME-CONFUSION-GUARD | `MAL-2025-PYPI-COLORAMA-SOLANA-STEALER` | NIST-800-218 SSDF PW.4, NIST-800-53 SI-7, EU CRA Annex I §1(2)(c) |
 | `NEW-CTRL-071` | AI-DISCOVERY-CREDIT-IN-COMPLIANCE-EVIDENCE | `MAL-2025-AI-FOUND-FFMPEG-BIGSLEEP` + `CVE-2025-6965` + `CVE-2025-0133` + ZeroPath quartet | NIST AI RMF MEASURE 2.7, ISO/IEC 42001 §6.1.4 (records of AI use), EU AI Act Art.12 (record-keeping) |
 | `NEW-CTRL-072` | PRIMARY-SOURCE-INTAKE-VENDOR-BLOG-COVERAGE | `CVE-2026-31635` (DirtyDecrypt) | NIST-800-53 SI-5 (security alerts / advisories), ISO-27001-2022 A.5.7 (threat intelligence), CIS Controls v8 7.1 |
-| `NEW-CTRL-073` | RESEARCHER-HANDLE-GITHUB-RELEASE-TRACKER | `CVE-2020-17103-REREGRESSION-2026` (MiniPlasma) + Nightmare-Eclipse cluster | NIST-800-53 SI-5, ISO-27001-2022 A.5.7, CIS Controls v8 7.1. Enforced operationally by `lib/source-advisories.js#FEEDS[nightmare-eclipse-github]` (github-events kind). |
+| `NEW-CTRL-073` | RESEARCHER-HANDLE-ACTIVITY-TRACKER | `CVE-2020-17103-REREGRESSION-2026` (MiniPlasma) + Nightmare-Eclipse cluster | NIST-800-53 SI-5, ISO-27001-2022 A.5.7, CIS Controls v8 7.1. Enforced operationally by `lib/source-advisories.js#FEEDS[nightmare-eclipse-gitlab]` (gitlab-activity kind). |
 | `NEW-CTRL-074` | CVE-REGRESSION-WATCHER | `CVE-2020-17103-REREGRESSION-2026` (MiniPlasma) | NIST-800-53 CM-3 (configuration-change control), NIST-800-53 SI-2, ISO-27001-2022 A.8.8 (vulnerability management). Enforced operationally by `lib/cve-regression-watcher.js` — surfaces historical-CVE references in poller diffs as candidate silent-regression cases. |
 | `NEW-CTRL-075` | AV-AGENT-CURRENCY-CROSS-VERIFICATION | `BUG-2026-NIGHTMARE-ECLIPSE-UNDEFEND` (UnDefend) | NIST-800-53 SI-3 + SI-4, ISO-27001-2022 A.8.7. Independent control-plane cross-check (Defender for Endpoint cloud telemetry / Intune compliance / SCCM inventory) for AV / EDR signature + platform currency; alert on drift > 7 days. |
 

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.19.8 — 2026-08-09
+
+Control identifiers are unique and uniformly shaped again. `AGENTS.md` states these IDs are stable and citable from skill bodies, operator reports and framework-gap analyses, and two things had drifted from that. Thirteen control classes carried a descriptive string where the identifier belongs — `MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT` rather than a number — and could not be cited under the contract at all; they are now `NEW-CTRL-126` through `NEW-CTRL-138`, keeping their names.
+
+Seven identifiers meant two different controls each. `NEW-CTRL-009` resolved to kernel-module inventory in some entries and to a registry cooldown policy in others, so a citation was ambiguous. In every case the duplicate was added after the identifier was already published — the original holder keeps its number, and the later control moves: `NEW-CTRL-139` (CI workflow trust-boundary isolation), `140` (registry cooldown policy), `141` (kernel exit-race CVE-class monitoring), `142` (SUID minimization for kernel-LPE carrier binaries), `143` (LLM-gateway MCP execution-endpoint privilege parity), `144` (embedded media-parser inventory and patch parity), `145` (actively-exploited OS-LPE remediation window). An operator citing one of those seven between its introduction and this release should remap; every other identifier is unchanged. The catalog now fails its own tests if an identifier is malformed or resolves to more than one control, and the `AGENTS.md` table is checked against the catalog so a documented name cannot drift from the control it names — it had, for the researcher-handle tracker, which the table still described as GitHub-specific after the feed moved to GitLab.
+
+Alongside this, 37 more CVEs report the controls they require, taking coverage to 461 of 1025.
+
+## 0.19.7 — 2026-08-09
+
+Another 66 CVEs report the controls they require, taking coverage to 424 of 1025. The set reaches beyond appliances into Roundcube and Zimbra webmail, SmarterMail, WatchGuard Firebox, VMware Aria Operations, GitLab, Vite, Windows NTFS, FreePBX and the Apple and Ivanti mobile estate.
+
+Two requirements dominate where the affected asset manages other assets. A device-management gateway reached before authentication is a fleet event rather than a host event: the vendor fix closes the injection path but leaves every configuration profile pushed, certificate issued and credential that transited the server untouched, so the requirement covers revoking what the server issued and invalidating device trust state, not just installing the update. And on a mobile estate the operative failure is deferral — an update prompt dismissed on a personally-carried device extends exposure to a confirmed-exploited kernel flaw for weeks while the console still reports the fleet as managed — so the requirement is enforcement with a deadline and loss of access past it, not a patch-level report.
+
+Entries state their own limits. Where a control bounds the damage without preventing the flaw, it says so rather than implying prevention; where the vendor ships no fix, the requirement describes the compensating control instead of a patch window.
+
 ## 0.19.6 — 2026-08-08
 
 Another 48 CVEs report the controls they require, taking the catalog to 358 of 1025. The set spans SharePoint and SolarWinds Web Help Desk deserialization, Samsung MagicINFO and SimpleHelp path traversal, Fortinet FortiClient EMS, Ivanti Endpoint Manager, CRI-O and containerd, and the Apple and Chromium memory-safety entries.

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-09T06:35:58.928Z",
+  "generated_at": "2026-08-10T03:54:15.172Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "aebdb8f8ea8f29fab794c12a13005fe2bca2d0185f2ca7c2217c9c813d27a059",
+    "manifest.json": "1f1d2fd1c07942e0923c7376185faefc0926d8843802a23b0f684080fe86d30f",
     "README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
     "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
     "data/attack-techniques.json": "6bc0619bcccceccc8d5c12aefa6c11197c625e5d7313e70474f2831e271b23f0",
@@ -16,7 +16,7 @@
     "data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "aa12abe32c909f97d66be9f9a1be220e4dfd0fccf291eb59ef8ba185c03fa489",
+    "data/zeroday-lessons.json": "e2b0ab27912295021ab6d1637d2471d7f7b7971116e679b689bf25b8c3c12d43",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
     "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",

package/data/_indexes/activity-feed.json

@@ -5,6 +5,14 @@
     "event_count": 63
   },
   "events": [
+    {
+      "date": "2026-08-09",
+      "type": "catalog_update",
+      "artifact": "data/zeroday-lessons.json",
+      "path": "data/zeroday-lessons.json",
+      "schema_version": "1.1.0",
+      "entry_count": 1025
+    },
     {
       "date": "2026-08-08",
       "type": "catalog_update",
@@ -29,14 +37,6 @@
       "schema_version": "1.0.0",
       "entry_count": 1025
     },
-    {
-      "date": "2026-08-08",
-      "type": "catalog_update",
-      "artifact": "data/zeroday-lessons.json",
-      "path": "data/zeroday-lessons.json",
-      "schema_version": "1.1.0",
-      "entry_count": 1025
-    },
     {
       "date": "2026-08-06",
       "type": "catalog_update",

package/data/_indexes/catalog-summaries.json

@@ -229,7 +229,7 @@
       "path": "data/zeroday-lessons.json",
       "purpose": "Distilled lessons from notable zero-days and campaigns (SesameOp, Copy Fail, Dirty Frag, Copilot RCE, Windsurf MCP). Each entry: technique, distinguishing characteristic, what it means for the framework lag.",
       "schema_version": "1.1.0",
-      "last_updated": "2026-08-08",
+      "last_updated": "2026-08-09",
       "tlp": "CLEAR",
       "source_confidence_default": "B2",
       "freshness_policy": {