@blamejs/exceptd-skills 0.20.1 → 0.21.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (94) hide show
  1. package/CHANGELOG.md +48 -0
  2. package/data/_indexes/_meta.json +50 -50
  3. package/data/_indexes/activity-feed.json +21 -21
  4. package/data/_indexes/catalog-summaries.json +10 -10
  5. package/data/_indexes/chains.json +2 -2
  6. package/data/_indexes/did-ladders.json +1 -1
  7. package/data/_indexes/frequency.json +122 -76
  8. package/data/_indexes/jurisdiction-clocks.json +2 -2
  9. package/data/_indexes/section-offsets.json +654 -654
  10. package/data/_indexes/summary-cards.json +34 -28
  11. package/data/_indexes/theater-fingerprints.json +1 -1
  12. package/data/_indexes/token-budget.json +241 -241
  13. package/data/_indexes/xref.json +34 -14
  14. package/data/atlas-ttps.json +246 -292
  15. package/data/attack-techniques.json +13 -1
  16. package/data/cve-catalog.json +833 -246
  17. package/data/cwe-catalog.json +6 -2
  18. package/data/d3fend-catalog.json +2 -3
  19. package/data/framework-control-gaps.json +479 -293
  20. package/data/global-frameworks.json +12 -12
  21. package/data/playbooks/ai-api.json +5 -5
  22. package/data/playbooks/ai-discovered-cve-triage.json +7 -7
  23. package/data/playbooks/cicd-pipeline-compromise.json +1 -2
  24. package/data/playbooks/cloud-iam-incident.json +11 -11
  25. package/data/playbooks/containers.json +3 -3
  26. package/data/playbooks/cred-stores.json +4 -4
  27. package/data/playbooks/crypto-codebase.json +1 -1
  28. package/data/playbooks/crypto.json +4 -4
  29. package/data/playbooks/hardening.json +3 -3
  30. package/data/playbooks/identity-sso-compromise.json +4 -3
  31. package/data/playbooks/idp-incident.json +14 -14
  32. package/data/playbooks/kernel.json +3 -3
  33. package/data/playbooks/llm-tool-use-exfil.json +1 -1
  34. package/data/playbooks/mcp.json +4 -4
  35. package/data/playbooks/post-quantum-migration.json +10 -10
  36. package/data/playbooks/ransomware.json +3 -3
  37. package/data/playbooks/runtime.json +3 -3
  38. package/data/playbooks/sbom.json +3 -3
  39. package/data/playbooks/secrets.json +7 -7
  40. package/data/playbooks/supply-chain-recovery.json +1 -2
  41. package/data/playbooks/webhook-callback-abuse.json +1 -1
  42. package/data/zeroday-lessons.json +804 -399
  43. package/lib/ttp-mapper.js +1 -1
  44. package/manifest-snapshot.json +23 -17
  45. package/manifest-snapshot.sha256 +1 -1
  46. package/manifest.json +126 -120
  47. package/package.json +2 -2
  48. package/sbom.cdx.json +184 -169
  49. package/scripts/backfill-theater-test.js +10 -10
  50. package/scripts/builders/did-ladders.js +1 -1
  51. package/scripts/builders/theater-fingerprints.js +1 -1
  52. package/scripts/check-atlas-catalog-currency.js +47 -4
  53. package/scripts/check-ism-control-references.js +221 -0
  54. package/scripts/check-test-count.js +9 -3
  55. package/scripts/predeploy.js +9 -0
  56. package/scripts/refresh-upstream-catalogs.js +9 -2
  57. package/scripts/release.js +6 -6
  58. package/scripts/sync-manifest-metadata.js +6 -6
  59. package/skills/ai-attack-surface/skill.md +11 -9
  60. package/skills/ai-c2-detection/skill.md +5 -6
  61. package/skills/ai-risk-management/skill.md +6 -5
  62. package/skills/api-security/skill.md +8 -8
  63. package/skills/attack-surface-pentest/skill.md +1 -1
  64. package/skills/cloud-iam-incident/skill.md +2 -2
  65. package/skills/cloud-security/skill.md +2 -1
  66. package/skills/compliance-theater/skill.md +4 -4
  67. package/skills/coordinated-vuln-disclosure/skill.md +1 -1
  68. package/skills/decompression-dos/skill.md +1 -1
  69. package/skills/dlp-gap-analysis/skill.md +3 -3
  70. package/skills/exploit-scoring/skill.md +3 -3
  71. package/skills/framework-gap-analysis/skill.md +3 -3
  72. package/skills/global-grc/skill.md +11 -11
  73. package/skills/idp-incident-response/skill.md +2 -2
  74. package/skills/incident-response-playbook/skill.md +18 -17
  75. package/skills/kernel-lpe-triage/skill.md +1 -1
  76. package/skills/log-injection-telemetry/skill.md +1 -1
  77. package/skills/mcp-agent-trust/skill.md +5 -4
  78. package/skills/mlops-security/skill.md +5 -5
  79. package/skills/multitenancy-isolation/skill.md +1 -1
  80. package/skills/policy-exception-gen/skill.md +1 -1
  81. package/skills/pqc-first/skill.md +1 -1
  82. package/skills/privacy-consent-ops/skill.md +1 -1
  83. package/skills/rag-pipeline-security/skill.md +1 -1
  84. package/skills/ransomware-response/skill.md +2 -2
  85. package/skills/researcher/skill.md +3 -3
  86. package/skills/sector-financial/skill.md +4 -4
  87. package/skills/sector-healthcare/skill.md +3 -2
  88. package/skills/sector-telecom/skill.md +8 -8
  89. package/skills/security-maturity-tiers/skill.md +8 -8
  90. package/skills/self-update-integrity/skill.md +1 -1
  91. package/skills/skill-update-loop/skill.md +3 -3
  92. package/skills/threat-model-currency/skill.md +6 -6
  93. package/skills/threat-modeling-methodology/skill.md +4 -4
  94. package/skills/zeroday-gap-learn/skill.md +3 -3
package/data/attack-techniques.json CHANGED
@@ -1043,6 +1043,8 @@
1043
1043
  "CVE-2025-32709",
1044
1044
  "CVE-2025-33073",
1045
1045
  "CVE-2025-38352",
1046
+ "CVE-2025-39682",
1047
+ "CVE-2025-39964",
1046
1048
  "CVE-2025-40602",
1047
1049
  "CVE-2025-41244",
1048
1050
  "CVE-2025-43300",
@@ -1073,6 +1075,7 @@
1073
1075
  "CVE-2026-46300",
1074
1076
  "CVE-2026-46333",
1075
1077
  "CVE-2026-48172",
1078
+ "CVE-2026-53266",
1076
1079
  "CVE-2026-53362",
1077
1080
  "CVE-2026-54420",
1078
1081
  "CVE-2026-56155",
@@ -2589,6 +2592,7 @@
2589
2592
  "CVE-2026-6973",
2590
2593
  "CVE-2026-72529",
2591
2594
  "CVE-2026-72530",
2595
+ "CVE-2026-7273",
2592
2596
  "CVE-2026-72898",
2593
2597
  "CVE-2026-73570",
2594
2598
  "CVE-2026-7473",
@@ -3677,6 +3681,7 @@
3677
3681
  "CVE-2026-21962",
3678
3682
  "CVE-2026-30615",
3679
3683
  "CVE-2026-60004",
3684
+ "CVE-2026-7273",
3680
3685
  "CVE-2026-8452",
3681
3686
  "CVE-2026-85706",
3682
3687
  "MAL-2026-3083",
@@ -4350,6 +4355,7 @@
4350
4355
  "CVE-2025-22226",
4351
4356
  "CVE-2025-23266",
4352
4357
  "CVE-2025-38352",
4358
+ "CVE-2025-39964",
4353
4359
  "CVE-2026-53362"
4354
4360
  ],
4355
4361
  "description_full": "Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment.(Citation: Docker Overview) There are multiple ways an adversary may escape from a container to a host environment. Examples include creating a container configured to mount the host’s filesystem using the bind parameter, which allows the adversary to drop payloads and execute control utilities such as cron on the host; utilizing a privileged container to run commands or load a malicious kernel module on the underlying host; or abusing system calls such as `unshare` and `keyctl` to escalate privileges and steal secrets.(Citation: Docker Bind Mounts)(Citation: Trend Micro Privileged Container)(Citation: Intezer Doki July 20)(Citation: Container Escape)(Citation: Crowdstrike Kubernetes Container Escape)(Citation: Keyctl-unmask) Additionally, an adversary may be able to exploit a compromised container with a mounted container management socket, such as `docker.sock`, to break out of the container via a [Container Administration Command](https://attack.mitre.org/techniques/T1609).(Citation: Container Escape) Adversaries may also escape via [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), such as exploiting vulnerabilities in global symbolic links in order to access the root directory of a host machine.(Citation: Windows Server Containers Are Open) In ESXi environments, an adversary may exploit a vulnerability in order to escape from a virtual machine into the hypervisor.(Citation: Broadcom VMSA-2025-004) Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, accessing other containers or virtual machines running on the host, or setting up a command and control channel on the host.",
@@ -6430,6 +6436,7 @@
6430
6436
  "CVE-2024-55956",
6431
6437
  "CVE-2024-9680",
6432
6438
  "CVE-2026-34486",
6439
+ "CVE-2026-7273",
6433
6440
  "CVE-2026-75650",
6434
6441
  "CVE-2026-81578",
6435
6442
  "CVE-2026-82078",
@@ -7219,6 +7226,7 @@
7219
7226
  "CVE-2024-12356",
7220
7227
  "CVE-2024-38812",
7221
7228
  "CVE-2024-38813",
7229
+ "CVE-2025-39682",
7222
7230
  "CVE-2026-34486",
7223
7231
  "CVE-2026-83548"
7224
7232
  ]
@@ -11834,6 +11842,7 @@
11834
11842
  "CVE-2026-34486",
11835
11843
  "CVE-2026-49869",
11836
11844
  "CVE-2026-60004",
11845
+ "CVE-2026-7273",
11837
11846
  "CVE-2026-73570",
11838
11847
  "CVE-2026-76460",
11839
11848
  "CVE-2026-76461",
@@ -15304,6 +15313,8 @@
15304
15313
  "CVE-2021-22991",
15305
15314
  "CVE-2021-27562",
15306
15315
  "CVE-2021-31166",
15316
+ "CVE-2025-39682",
15317
+ "CVE-2025-39964",
15307
15318
  "CVE-2026-20349",
15308
15319
  "CVE-2026-67277"
15309
15320
  ]
@@ -21360,7 +21371,8 @@
21360
21371
  "cve_refs": [
21361
21372
  "CVE-2018-0171",
21362
21373
  "CVE-2022-40684",
21363
- "CVE-2026-20079"
21374
+ "CVE-2026-20079",
21375
+ "CVE-2026-7273"
21364
21376
  ]
21365
21377
  },
21366
21378
  "T1608.001": {