@blamejs/exceptd-skills 0.19.7 → 0.19.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/AGENTS.md +5 -3
  2. package/CHANGELOG.md +8 -0
  3. package/data/_indexes/_meta.json +3 -3
  4. package/data/zeroday-lessons.json +993 -97
  5. package/lib/source-advisories.js +1 -1
  6. package/manifest.json +53 -53
  7. package/package.json +1 -1
  8. package/sbom.cdx.json +19 -19
package/AGENTS.md CHANGED
@@ -222,8 +222,10 @@ Recently added (use the IDs in skill prose and operator briefings; full text in
222
222
 
223
223
  | ID | Name | Surfacing zero-day | Coverage gap closed |
224
224
  |---|---|---|---|
225
- | `NEW-CTRL-048` | NPM-MAINTAINER-MFA-ENFORCEMENT / KERNEL-EXIT-RACE-CVE-CLASS-MONITORING | `MAL-2026-NODE-IPC-STEALER`, `CVE-2026-46333` | NIST-800-218 SSDF, NIST-800-53 IA-5/AU-2/SI-4, NIS2 Art.21 supply-chain |
226
- | `NEW-CTRL-049` | LOCKFILE-INTEGRITY-VERIFIED-AT-CI-BOOT / SUID-MINIMIZATION-FOR-KERNEL-LPE-CARRIER-BINARIES | `MAL-2026-NODE-IPC-STEALER`, `CVE-2026-46333` | NIST-800-218 SSDF, EU CRA Art.13, SLSA Build L3, NIST-800-53 CM-6/AC-3 |
225
+ | `NEW-CTRL-048` | NPM-MAINTAINER-MFA-ENFORCEMENT | `MAL-2026-NODE-IPC-STEALER` | NIST-800-218 SSDF, NIST-800-53 IA-5, NIS2 Art.21 supply-chain |
226
+ | `NEW-CTRL-049` | LOCKFILE-INTEGRITY-VERIFIED-AT-CI-BOOT | `MAL-2026-NODE-IPC-STEALER` | NIST-800-218 SSDF, EU CRA Art.13, SLSA Build L3 |
227
+ | `NEW-CTRL-141` | KERNEL-EXIT-RACE-CVE-CLASS-MONITORING | `CVE-2026-46333` | NIST-800-53 AU-2/SI-4 |
228
+ | `NEW-CTRL-142` | SUID-MINIMIZATION-FOR-KERNEL-LPE-CARRIER-BINARIES | `CVE-2026-46333` | NIST-800-53 CM-6/AC-3 |
227
229
  | `NEW-CTRL-050` | AI-ASSISTANT-CONFIG-FILE-PERMISSION-LOCKDOWN | `MAL-2026-SHAI-HULUD-OSS` | NIST-800-53 AC-3/CM-6. Enforced operationally by `exceptd doctor --ai-config`. |
228
230
  | `NEW-CTRL-051` | NPM-PUBLISH-TOKEN-WORKSTATION-ISOLATION | `MAL-2026-SHAI-HULUD-OSS` | NIST-800-53 IA-5, NIST-800-218 SSDF PW.4 |
229
231
  | `NEW-CTRL-052` | GITHUB-REPO-PATTERN-MONITORING-FOR-EXFIL-CHANNELS | `MAL-2026-SHAI-HULUD-OSS` | NIST-800-53 SI-4. Enforced operationally by `exceptd watchlist --org-scan`. |
@@ -247,7 +249,7 @@ Recently added (use the IDs in skill prose and operator briefings; full text in
247
249
  | `NEW-CTRL-070` | TYPOSQUAT-INSTALL-TIME-NAME-CONFUSION-GUARD | `MAL-2025-PYPI-COLORAMA-SOLANA-STEALER` | NIST-800-218 SSDF PW.4, NIST-800-53 SI-7, EU CRA Annex I §1(2)(c) |
248
250
  | `NEW-CTRL-071` | AI-DISCOVERY-CREDIT-IN-COMPLIANCE-EVIDENCE | `MAL-2025-AI-FOUND-FFMPEG-BIGSLEEP` + `CVE-2025-6965` + `CVE-2025-0133` + ZeroPath quartet | NIST AI RMF MEASURE 2.7, ISO/IEC 42001 §6.1.4 (records of AI use), EU AI Act Art.12 (record-keeping) |
249
251
  | `NEW-CTRL-072` | PRIMARY-SOURCE-INTAKE-VENDOR-BLOG-COVERAGE | `CVE-2026-31635` (DirtyDecrypt) | NIST-800-53 SI-5 (security alerts / advisories), ISO-27001-2022 A.5.7 (threat intelligence), CIS Controls v8 7.1 |
250
- | `NEW-CTRL-073` | RESEARCHER-HANDLE-GITHUB-RELEASE-TRACKER | `CVE-2020-17103-REREGRESSION-2026` (MiniPlasma) + Nightmare-Eclipse cluster | NIST-800-53 SI-5, ISO-27001-2022 A.5.7, CIS Controls v8 7.1. Enforced operationally by `lib/source-advisories.js#FEEDS[nightmare-eclipse-github]` (github-events kind). |
252
+ | `NEW-CTRL-073` | RESEARCHER-HANDLE-ACTIVITY-TRACKER | `CVE-2020-17103-REREGRESSION-2026` (MiniPlasma) + Nightmare-Eclipse cluster | NIST-800-53 SI-5, ISO-27001-2022 A.5.7, CIS Controls v8 7.1. Enforced operationally by `lib/source-advisories.js#FEEDS[nightmare-eclipse-gitlab]` (gitlab-activity kind). |
251
253
  | `NEW-CTRL-074` | CVE-REGRESSION-WATCHER | `CVE-2020-17103-REREGRESSION-2026` (MiniPlasma) | NIST-800-53 CM-3 (configuration-change control), NIST-800-53 SI-2, ISO-27001-2022 A.8.8 (vulnerability management). Enforced operationally by `lib/cve-regression-watcher.js` — surfaces historical-CVE references in poller diffs as candidate silent-regression cases. |
252
254
  | `NEW-CTRL-075` | AV-AGENT-CURRENCY-CROSS-VERIFICATION | `BUG-2026-NIGHTMARE-ECLIPSE-UNDEFEND` (UnDefend) | NIST-800-53 SI-3 + SI-4, ISO-27001-2022 A.8.7. Independent control-plane cross-check (Defender for Endpoint cloud telemetry / Intune compliance / SCCM inventory) for AV / EDR signature + platform currency; alert on drift > 7 days. |
253
255
 
package/CHANGELOG.md CHANGED
@@ -1,5 +1,13 @@
1
1
  # Changelog
2
2
 
3
+ ## 0.19.8 — 2026-08-09
4
+
5
+ Control identifiers are unique and uniformly shaped again. `AGENTS.md` states these IDs are stable and citable from skill bodies, operator reports and framework-gap analyses, and two things had drifted from that. Thirteen control classes carried a descriptive string where the identifier belongs — `MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT` rather than a number — and could not be cited under the contract at all; they are now `NEW-CTRL-126` through `NEW-CTRL-138`, keeping their names.
6
+
7
+ Seven identifiers meant two different controls each. `NEW-CTRL-009` resolved to kernel-module inventory in some entries and to a registry cooldown policy in others, so a citation was ambiguous. In every case the duplicate was added after the identifier was already published — the original holder keeps its number, and the later control moves: `NEW-CTRL-139` (CI workflow trust-boundary isolation), `140` (registry cooldown policy), `141` (kernel exit-race CVE-class monitoring), `142` (SUID minimization for kernel-LPE carrier binaries), `143` (LLM-gateway MCP execution-endpoint privilege parity), `144` (embedded media-parser inventory and patch parity), `145` (actively-exploited OS-LPE remediation window). An operator citing one of those seven between its introduction and this release should remap; every other identifier is unchanged. The catalog now fails its own tests if an identifier is malformed or resolves to more than one control, and the `AGENTS.md` table is checked against the catalog so a documented name cannot drift from the control it names — it had, for the researcher-handle tracker, which the table still described as GitHub-specific after the feed moved to GitLab.
8
+
9
+ Alongside this, 37 more CVEs report the controls they require, taking coverage to 461 of 1025.
10
+
3
11
  ## 0.19.7 — 2026-08-09
4
12
 
5
13
  Another 66 CVEs report the controls they require, taking coverage to 424 of 1025. The set reaches beyond appliances into Roundcube and Zimbra webmail, SmarterMail, WatchGuard Firebox, VMware Aria Operations, GitLab, Vite, Windows NTFS, FreePBX and the Apple and Ivanti mobile estate.
package/data/_indexes/_meta.json CHANGED
@@ -1,10 +1,10 @@
1
1
  {
2
2
  "schema_version": "1.1.0",
3
- "generated_at": "2026-08-09T10:13:44.639Z",
3
+ "generated_at": "2026-08-10T03:54:15.172Z",
4
4
  "generator": "scripts/build-indexes.js",
5
5
  "source_count": 64,
6
6
  "source_hashes": {
7
- "manifest.json": "25e19ace806ba31cd59aa023427d4969fc610c0cd039f51f49aa7bba8836a5f4",
7
+ "manifest.json": "1f1d2fd1c07942e0923c7376185faefc0926d8843802a23b0f684080fe86d30f",
8
8
  "README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
9
9
  "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
10
10
  "data/attack-techniques.json": "6bc0619bcccceccc8d5c12aefa6c11197c625e5d7313e70474f2831e271b23f0",
@@ -16,7 +16,7 @@
16
16
  "data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
17
17
  "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
18
18
  "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
19
- "data/zeroday-lessons.json": "fdd6944844660d6057c531c3046b3f7bb665260c1986c82a9b9755eeb6d93e56",
19
+ "data/zeroday-lessons.json": "e2b0ab27912295021ab6d1637d2471d7f7b7971116e679b689bf25b8c3c12d43",
20
20
  "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
21
21
  "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
22
22
  "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",