@blamejs/exceptd-skills 0.21.7 → 0.21.8

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.21.8 — 2026-09-27
+
+1,998 zero-day lesson texts and 2 catalog fields no longer cite the curation input instead of a source, as in "Packet: ...", "Packet fields for CVE-...", "the packet's own ..." or a catalog field name such as `cisa_kev` or `live_patch_notes` quoted as evidence. Each text now states the fact directly, and names CISA's KEV entry or the vendor advisory where that is the source. The `pipeline-wording` class in the catalog gap audit falls from 2,159 texts to 159, and the predeploy budget gate now holds it at 159.
+
 ## 0.21.7 — 2026-09-27
 
 The catalog holds 1,758 CVEs after one addition from CISA KEV: CVE-2021-1905, a use-after-free in the Qualcomm Adreno GPU driver on Android and other Snapdragon devices. It has no public exploit, and the fix needs a device restart. Google's Threat Analysis Group attributes its use as a zero-day to the commercial surveillance vendor Intellexa.

package/data/_indexes/_meta.json

@@ -1,14 +1,14 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-09-27T17:35:13.161Z",
+  "generated_at": "2026-09-27T22:56:11.649Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "1a53c846b758ff96c4214fd7d65ef8bdd9344f5c1daf6df2e0550a07611aa617",
+    "manifest.json": "43a28aa0bf1a3d6cf1cab2b61d62f06fc24a81edead71e6bb9787dec5fb1fee4",
     "README.md": "864570c1f7fb221b0176d22d3b0823a8d077d6a7209edc6045b426b1e9ec555d",
     "data/atlas-ttps.json": "c36c0a27c8de8a37a7070923d7b187345c46db9db778f58e4637f1f81ca6d6b1",
     "data/attack-techniques.json": "9857a11bd035c8638e61b200cdabea0cc43f0115b239e4941a19682076a1cfd3",
-    "data/cve-catalog.json": "d4632abe8bda7993fcdefbb586e1ba7139c55e22a871b2bb167703fb9c00392c",
+    "data/cve-catalog.json": "3a023a3d5c29b02cd23782936db8a2e863837f95dd715e0d3f4579cf088f298d",
     "data/cwe-catalog.json": "2116d47911a3e50b46495b51a31b12d0aede23233a62ef1362cb72810680b57c",
     "data/d3fend-catalog.json": "feec37e4b0a40cd7bc14616b50e7b9bcdb58a92d8e9326f9e2e632896d8ea576",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
@@ -16,7 +16,7 @@
     "data/framework-control-gaps.json": "79e40362b0a71582a88dd2f4af70715218cef45fb9d3e1c00955bda642dda089",
     "data/global-frameworks.json": "86249047c50d2584b4854eb381ba53c309c0e6e29d4cb0e522b4ba1405481de6",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "fc805929c375a3e4dfafaa5fdde9a54fd203ac3c44c1b02ae76e4aa9f7e82d62",
+    "data/zeroday-lessons.json": "4f472ef8b15d0634dc37f1c126429d601f3b537c875dbf1052b1623f54a6ce9f",
     "skills/kernel-lpe-triage/skill.md": "78a547771c42b9348a1f80201e0f1b8a5ed3e7b4f15b35b1f64cf4ee54b0480b",
     "skills/ai-attack-surface/skill.md": "bc9084127e4e928cba439187025f9e77aaca8089fe64891312824e74dd9fdb5b",
     "skills/mcp-agent-trust/skill.md": "c20bda4c1267b16db4f713667216d93e0ab4b98c0fb244024749dcfb32d709cf",

package/data/cve-catalog.json

@@ -16825,7 +16825,7 @@
     "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2019-2725 (CWE-74, CVSS 9.8, affected 10.3.6.0.0 and 12.1.3.0.0) and the CISA KEV record (added 2022-01-10, due 2022-07-10, ransomware Known). Exploit availability confirmed against rapid7/metasploit-framework and projectdiscovery/nuclei-templates. Oracle's alert-cve-2019-2725 page returned HTTP 403 and could not be quoted, so vendor wording, patch identifiers and any acknowledgement are absent by omission rather than by judgement.",
     "ai_assisted_weaponization": false,
-    "active_exploitation_notes": "CISA added the CVE to KEV on 2022-01-10 with a 2022-07-10 due date and records the ransomware association as Known. Oracle handled the fix as a standalone Security Alert (alert-cve-2019-2725) rather than folding it into a quarterly Critical Patch Update, and the packet's own vendor-advisory reference list for this CVE also carries the July 2019 and January 2020 Critical Patch Update pages - an out-of-band alert is the vendor's own signal that the flaw was already being used when the fix shipped. The Oracle alert page returned HTTP 403 to every fetch in this pass, so no vendor wording and no credit line is quoted here. No named campaign, actor or ransomware family is confirmed from a source retrieved for this entry: the ransomware association is the KEV record's own field, not an attribution report read here.",
+    "active_exploitation_notes": "CISA added the CVE to KEV on 2022-01-10 with a 2022-07-10 due date and records the ransomware association as Known. Oracle handled the fix as a standalone Security Alert (alert-cve-2019-2725) rather than folding it into a quarterly Critical Patch Update, and Oracle's vendor advisories for this CVE also include the July 2019 and January 2020 Critical Patch Update pages. An out-of-band alert is the vendor's own signal that the flaw was already being used when the fix shipped. The Oracle alert page returned HTTP 403 to every fetch made for this entry, so no vendor wording and no credit line is quoted here. No named campaign, actor or ransomware family is confirmed from a source retrieved for this entry: the ransomware association is the KEV record's own field, not an attribution report read here.",
     "attack_refs": [
       "T1190",
       "T1059",
@@ -23338,7 +23338,7 @@
     "ai_discovered": false,
     "ai_discovery_notes": "Apple credits 'an anonymous researcher' in HT212807. No AI tooling is named, and the report predates AI-assisted vulnerability discovery becoming an operational reality. The researcher's identity is withheld by Apple, not unknown to it, which is why the source is recorded as human_researcher rather than unknown.",
     "ai_discovery_source": "human_researcher",
-    "discovery_attribution_note": "Curated from NVD CVE-2021-30858 (CWE-416, CVSS 8.8), the CISA KEV record (added 2021-11-03, due 2021-11-17) including its note about non-Apple WebKit embedders, and Apple support document HT212807 for iOS 14.8 / iPadOS 14.8 (13 September 2021), which supplies the impact wording and the 'an anonymous researcher' credit. The packet's own references array for this CVE is empty; HT212807 was retrieved for this pass. Absence of a public exploit module confirmed against rapid7/metasploit-framework and projectdiscovery/nuclei-templates.",
+    "discovery_attribution_note": "This entry draws on NVD CVE-2021-30858 (CWE-416, CVSS 8.8), the CISA KEV record (added 2021-11-03, due 2021-11-17) including its note about non-Apple WebKit embedders, and Apple support document HT212807 for iOS 14.8 / iPadOS 14.8 (13 September 2021), which supplies the impact wording and the 'an anonymous researcher' credit. HT212807 was retrieved for this entry. The absence of a public exploit module was confirmed against rapid7/metasploit-framework and projectdiscovery/nuclei-templates.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple support document HT212807, covering iOS 14.8 and iPadOS 14.8 released 13 September 2021, states for this CVE: 'Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.' The credit is to 'an anonymous researcher' - Apple names no reporting organisation. CISA added the CVE to KEV on 2021-11-03 with a 2021-11-17 due date and records the ransomware association as Unknown. Apple names no campaign and no actor, and no named campaign is confirmed from a source retrieved for this entry. The one hard adjacency worth carrying: the same 14.8 update also fixed CVE-2021-30860, so an unpatched device carried two flaws Apple describes as possibly actively exploited.",
     "attack_refs": [