@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/lib/external-intelligence-risk.mjs

@@ -1,124 +1,2 @@
-// Converts already-returned, separately attributed external observations into
-// a conservative Risk contribution. Unknown providers and lone publisher
-// families never contribute. Two adapters operated by the same publisher are
-// deliberately one corroboration source, even when their datasets differ.
-export const EXTERNAL_INTELLIGENCE_CALIBRATION_VERSION = 1;
-export const EXTERNAL_INTELLIGENCE_RECENT_DAYS = 90;
-const DAY_MS = 24 * 60 * 60 * 1000;
-const MAX_CLOCK_SKEW_MS = DAY_MS;
-const MAX_PROVIDERS = 10;
-const MAX_FINDINGS_PER_PROVIDER = 100;
-const POSITIVE_STATES = new Set(['success', 'partial']);
-const QUALIFYING_CATEGORIES = new Set(['phishing', 'malware']);
-// Only built-in provider IDs can affect the built-in score. The two community
-// malware datasets share one publisher family and therefore cannot corroborate
-// one another by themselves.
-import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
-import { canonicalRegistrableDomain } from "./registrable-domain.mjs";
-import { THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_ENVELOPE_VERSION, THREAT_INTELLIGENCE_SCHEMA, } from "./threat-intelligence-types.mjs";
-const PUBLISHER_FAMILIES = Object.freeze({
-    urlscan_search: 'archived-scan-publisher',
-    urlhaus_host: 'community-malware-publisher',
-    threatfox_domain_ioc: 'community-malware-publisher',
-});
-function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
-}
-function timestamp(value) {
-    const normalized = normalizeExplicitIsoTimestamp(value);
-    return normalized ? Date.parse(normalized) : null;
-}
-function providerEvidence(value, expectedDomain) {
-    const provider = record(value);
-    const identity = record(provider?.provider);
-    const observation = record(provider?.observation);
-    const target = record(provider?.target);
-    const providerId = typeof identity?.id === 'string' ? identity.id : '';
-    const publisherFamily = Object.hasOwn(PUBLISHER_FAMILIES, providerId)
-        ? PUBLISHER_FAMILIES[providerId]
-        : null;
-    if (provider?.schema !== THREAT_INTELLIGENCE_SCHEMA
-        || provider.version !== THREAT_INTELLIGENCE_CONTRACT_VERSION
-        || target?.type !== 'domain'
-        || target.exposure !== 'registrable_domain'
-        || target.value !== expectedDomain
-        || !publisherFamily
-        || typeof provider?.state !== 'string'
-        || !POSITIVE_STATES.has(provider.state)
-        || !Array.isArray(provider.findings))
-        return null;
-    const observedAt = timestamp(observation?.observedAt);
-    let latestFindingAt = null;
-    let qualifyingFindings = 0;
-    for (const item of provider.findings.slice(0, MAX_FINDINGS_PER_PROVIDER)) {
-        const finding = record(item);
-        if (!finding || typeof finding.category !== 'string' || !QUALIFYING_CATEGORIES.has(finding.category))
-            continue;
-        const firstObservedAt = timestamp(finding.firstObservedAt);
-        const lastObservedAt = timestamp(finding.lastObservedAt);
-        if (firstObservedAt !== null && lastObservedAt !== null && firstObservedAt > lastObservedAt)
-            continue;
-        qualifyingFindings += 1;
-        const candidate = lastObservedAt ?? firstObservedAt;
-        if (candidate !== null && (latestFindingAt === null || candidate > latestFindingAt))
-            latestFindingAt = candidate;
-    }
-    if (!qualifyingFindings)
-        return null;
-    let ageDays = null;
-    if (observedAt !== null && latestFindingAt !== null && latestFindingAt <= observedAt + MAX_CLOCK_SKEW_MS) {
-        ageDays = Math.max(0, Math.floor((observedAt - latestFindingAt) / DAY_MS));
-    }
-    return {
-        providerId,
-        publisherFamily,
-        qualifyingFindings,
-        lastObservedAt: latestFindingAt === null ? null : new Date(latestFindingAt).toISOString(),
-        ageDays,
-        recent: ageDays !== null && ageDays <= EXTERNAL_INTELLIGENCE_RECENT_DAYS,
-    };
-}
-export function calibrateExternalIntelligenceRisk(value, expectedDomainValue) {
-    const envelope = record(value);
-    const expectedDomain = canonicalRegistrableDomain(expectedDomainValue);
-    const providers = expectedDomain
-        && envelope?.version === THREAT_INTELLIGENCE_ENVELOPE_VERSION
-        && Array.isArray(envelope.providers)
-        ? envelope.providers.slice(0, MAX_PROVIDERS)
-        : [];
-    const byProvider = new Map();
-    for (const item of providers) {
-        const evidence = providerEvidence(item, expectedDomain ?? '');
-        if (!evidence || byProvider.has(evidence.providerId))
-            continue;
-        byProvider.set(evidence.providerId, evidence);
-    }
-    const sources = [...byProvider.values()].sort((a, b) => a.providerId.localeCompare(b.providerId));
-    const publisherFamilies = new Set(sources.map((source) => source.publisherFamily));
-    const recentPublisherFamilies = new Set(sources.filter((source) => source.recent).map((source) => source.publisherFamily));
-    const knownAges = sources.map((source) => source.ageDays).filter((age) => age !== null);
-    const independentPublisherCount = publisherFamilies.size;
-    const recentPublisherCount = recentPublisherFamilies.size;
-    let contribution = 0;
-    let factor = null;
-    if (independentPublisherCount >= 2) {
-        contribution = recentPublisherCount >= 2 ? 18 : 10;
-        factor = {
-            label: recentPublisherCount >= 2
-                ? 'Corroborated recent external phishing/malware records'
-                : 'Corroborated external phishing/malware records',
-            delta: contribution,
-        };
-    }
-    return {
-        version: EXTERNAL_INTELLIGENCE_CALIBRATION_VERSION,
-        contribution,
-        factor,
-        eligibleProviderCount: sources.length,
-        independentPublisherCount,
-        recentPublisherCount,
-        freshestAgeDays: knownAges.length ? Math.min(...knownAges) : null,
-        unknownAgeProviderCount: sources.filter((source) => source.ageDays === null).length,
-        sources,
-    };
-}
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/external-intelligence-risk.mjs";

package/lib/favicon.mjs

@@ -1,50 +1,30 @@
-// Favicon-hash fetch - a lookalike/typosquat domain that serves the same
-// favicon as a brand's real site is a strong sign of a cloned phishing kit
-// (attackers copy the favicon along with the rest of the page); a domain
-// that merely resolves and serves *some* page proves much less.
-//
-// Two hashes are produced from the same bytes:
-//   - hash:  exact SHA-256 of the raw bytes. Zero false positives, but only
-//            catches a byte-for-byte copy.
-//   - phash: perceptual (fuzzy) dHash (lib/perceptual-hash.mts). Catches a
-//            resized/recompressed/re-saved copy that's visually identical but
-//            no longer byte-identical - the common case when the favicon
-//            passed through a different tool than the original. Null when the
-//            image format can't be decoded (GIF/JPEG/SVG), so it strictly
-//            adds coverage without weakening the exact tier.
+// Bounded favicon acquisition. Recognised image bytes produce an exact SHA-256;
+// supported decoded pixels can also produce a heuristic dHash. Neither match
+// establishes ownership, shared infrastructure or maliciousness. HTML error
+// bodies are not image evidence and must not end candidate fallback.
 import * as crypto from 'node:crypto';
 import { safeFetch, readBytesCapped } from "./safe-fetch.mjs";
 import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
 import { faviconPerceptualHash } from "./perceptual-hash.mjs";
+import { analyzeStaticHtml } from "./static-html-analysis.mjs";
+import { isHtmlElement, parseBoundedHtml } from "./bounded-html-document.mjs";
 import { FAVICON_FETCH_TIMEOUT_MS, MAX_FAVICON_BYTES, MAX_FAVICON_CANDIDATES, } from "./outbound-request-bounds.mjs";
 // Extracts favicon URLs declared in the page's own <link rel="...icon..."> tags
 // (resolved to absolute URLs against the page origin), in preference order:
-// standard "icon"/"shortcut icon" first, then "apple-touch-icon". Many modern
-// sites (e.g. npm) serve no /favicon.ico at all and only declare a PNG on a
-// CDN this way, so checking only /favicon.ico misses them entirely. data:
+// standard "icon"/"shortcut icon" first, then "apple-touch-icon". data:
 // URIs are passed through verbatim - decodeFaviconCandidate handles them
 // without a network fetch.
-function extractIconUrls(html, baseUrl) {
-    const links = [];
-    for (const tag of html.match(/<link\b[^>]*>/gi) || []) {
-        const rel = (tag.match(/\brel\s*=\s*["']([^"']*)["']/i) || [])[1];
-        if (!rel || !/icon/i.test(rel))
-            continue;
-        const href = (tag.match(/\bhref\s*=\s*["']([^"']+)["']/i) || [])[1];
-        if (!href)
-            continue;
-        links.push({ href: href.trim(), priority: /apple-touch/i.test(rel) ? 1 : 0 });
-    }
-    links.sort((a, b) => a.priority - b.priority);
+function extractIconUrls(html, baseUrl, suppliedAnalysis) {
+    const analysis = suppliedAnalysis ?? analyzeStaticHtml(html, { baseUrl });
     const urls = [];
-    for (const { href } of links) {
+    for (const { href } of analysis.iconLinks) {
         if (/^data:/i.test(href)) {
             urls.push(href);
             continue;
         }
         try {
-            const resolved = new URL(href, baseUrl);
-            if (resolved.protocol === 'http:' || resolved.protocol === 'https:')
+            const resolved = new URL(href, analysis.effectiveBaseUrl ?? baseUrl);
+            if (['http:', 'https:'].includes(resolved.protocol) && !resolved.username && !resolved.password)
                 urls.push(resolved.toString());
         }
         catch {
@@ -56,21 +36,114 @@ function extractIconUrls(html, baseUrl) {
 // Decodes an inline `data:` favicon (base64 or percent-encoded) into a byte
 // buffer, bounded to MAX_FAVICON_BYTES. Returns null on anything malformed.
 function decodeDataUri(uri) {
+    // Percent encoding is at most three input characters per output byte.
+    // Refuse oversized encoded input before slicing or decoding it.
+    if (uri.length > MAX_FAVICON_BYTES * 3 + 128)
+        return null;
     const comma = uri.indexOf(',');
-    if (comma === -1)
+    if (comma === -1 || comma > 128)
         return null;
     const meta = uri.slice(5, comma);
     const data = uri.slice(comma + 1);
     try {
-        const bytes = /;base64/i.test(meta)
+        const base64 = /;base64$/i.test(meta);
+        if (base64 && (data.length > Math.ceil(MAX_FAVICON_BYTES / 3) * 4
+            || !/^[A-Za-z0-9+/]*={0,2}$/u.test(data)))
+            return null;
+        const bytes = base64
             ? Buffer.from(data, 'base64')
-            : Buffer.from(decodeURIComponent(data), 'latin1');
+            : Buffer.from(decodeURIComponent(data), 'utf8');
         return bytes.length > 0 && bytes.length <= MAX_FAVICON_BYTES ? bytes : null;
     }
     catch {
         return null;
     }
 }
+// Admission recognises container framing, not every codec feature or rendered
+// meaning. Exact-only formats remain usable; fuzzy decoding has its own pixel
+// and inflate limits. All loops here operate within MAX_FAVICON_BYTES.
+function isFaviconImage(bytes) {
+    if (bytes.length < 6 || bytes.length > MAX_FAVICON_BYTES)
+        return false;
+    if (bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]))) {
+        let dataSeen = false;
+        for (let offset = 8; offset + 12 <= bytes.length;) {
+            const size = bytes.readUInt32BE(offset);
+            const end = offset + 12 + size;
+            if (end > bytes.length)
+                return false;
+            const type = bytes.toString('ascii', offset + 4, offset + 8);
+            if (offset === 8 && (type !== 'IHDR' || size !== 13
+                || bytes.readUInt32BE(offset + 8) === 0 || bytes.readUInt32BE(offset + 12) === 0))
+                return false;
+            if (type === 'IDAT' && size > 0)
+                dataSeen = true;
+            if (type === 'IEND')
+                return size === 0 && dataSeen && end === bytes.length;
+            offset = end;
+        }
+        return false;
+    }
+    if (bytes.readUInt32LE(0) === 0x00010000) {
+        const count = bytes.readUInt16LE(4);
+        const directoryEnd = 6 + count * 16;
+        if (!count || directoryEnd > bytes.length)
+            return false;
+        for (let index = 0; index < count; index += 1) {
+            const entry = 6 + index * 16;
+            const size = bytes.readUInt32LE(entry + 8);
+            const offset = bytes.readUInt32LE(entry + 12);
+            if (size < 12 || offset < directoryEnd || offset + size > bytes.length)
+                continue;
+            const payload = bytes.subarray(offset, offset + size);
+            if (payload.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]))
+                || [12, 40, 52, 56, 108, 124].includes(payload.readUInt32LE(0)))
+                return true;
+        }
+        return false;
+    }
+    if (/^GIF8[79]a$/u.test(bytes.toString('ascii', 0, 6))) {
+        return bytes.length >= 14 && bytes.readUInt16LE(6) > 0 && bytes.readUInt16LE(8) > 0 && bytes.at(-1) === 0x3b;
+    }
+    if (bytes.length >= 12 && bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff) {
+        return bytes.at(-2) === 0xff && bytes.at(-1) === 0xd9;
+    }
+    if (bytes.length >= 20 && bytes.toString('ascii', 0, 4) === 'RIFF'
+        && bytes.toString('ascii', 8, 12) === 'WEBP') {
+        return bytes.readUInt32LE(4) + 8 === bytes.length && ['VP8 ', 'VP8L', 'VP8X'].includes(bytes.toString('ascii', 12, 16));
+    }
+    // Standalone SVG needs an SVG root, not an SVG embedded in an HTML error
+    // page. Native tree construction discards neither an HTML wrapper nor sibling
+    // content here. No script, entity, resource or stylesheet is executed.
+    const source = bytes.toString('utf8');
+    if (!source.includes('<svg'))
+        return false;
+    const parsed = parseBoundedHtml(source);
+    if (parsed.inputLimitReached || parsed.constructionLimitReached)
+        return false;
+    const html = parsed.document.childNodes.find(isHtmlElement);
+    if (html?.sourceCodeLocation?.startTag || parsed.document.childNodes.some((node) => node.nodeName === '#documentType' && 'name' in node && node.name !== 'svg'))
+        return false;
+    const head = html?.childNodes.find((node) => isHtmlElement(node) && node.tagName === 'head');
+    if (head && isHtmlElement(head) && (head.sourceCodeLocation?.startTag
+        || head.childNodes.some((node) => node.nodeName !== '#comment'
+            && !(node.nodeName === '#text' && 'value' in node && !node.value.trim()))))
+        return false;
+    const body = html?.childNodes.find((node) => isHtmlElement(node) && node.tagName === 'body');
+    if (!body || !isHtmlElement(body) || body.sourceCodeLocation?.startTag)
+        return false;
+    const content = body.childNodes.filter((node) => node.nodeName !== '#comment'
+        && !(node.nodeName === '#text' && 'value' in node && !node.value.trim()));
+    const root = content[0];
+    if (content.length !== 1 || !root || !('tagName' in root) || root.tagName !== 'svg'
+        || root.namespaceURI !== 'http://www.w3.org/2000/svg'
+        || !root.attrs.some((attribute) => attribute.name === 'xmlns' && attribute.value === 'http://www.w3.org/2000/svg'))
+        return false;
+    const location = root.sourceCodeLocation;
+    if (!location?.startTag)
+        return false;
+    return Boolean(location.endTag || /\/\s*>$/u.test(source.slice(location.startTag.startOffset, location.startTag.endOffset)));
+}
 // Returns the favicon bytes for one candidate URL (a real fetch, or an inline
 // data: decode), or null if it can't be retrieved/used.
 async function fetchFaviconBytes(url, headers, fetcher, timeoutMs) {
@@ -107,15 +180,15 @@ async function fetchFaviconBytes(url, headers, fetcher, timeoutMs) {
 // provided (the deep-check path already has the homepage in hand), is scanned
 // for declared <link rel="icon"> URLs, which are tried before the bare
 // /favicon.ico fallback.
-function buildFaviconCandidates(domain, html = '') {
+function buildFaviconCandidates(domain, html = '', options = {}) {
     const candidates = [];
     const seen = new Set();
     const add = (url) => { if (url && !seen.has(url)) {
         seen.add(url);
         candidates.push(url);
     } };
-    if (html)
-        for (const url of extractIconUrls(html, `https://${domain}/`))
+    if (html || options.htmlAnalysis)
+        for (const url of extractIconUrls(html, options.baseUrl ?? `https://${domain}/`, options.htmlAnalysis))
             add(url);
     add(`https://${domain}/favicon.ico`);
     add(`https://${domain}/favicon.svg`);
@@ -123,16 +196,19 @@ function buildFaviconCandidates(domain, html = '') {
     add(`http://${domain}/favicon.svg`);
     return candidates.slice(0, MAX_FAVICON_CANDIDATES);
 }
-async function fetchFaviconHash(domain, { html = '', fetcher = safeFetch, timeoutMs = FAVICON_FETCH_TIMEOUT_MS } = {}) {
+async function fetchFaviconHash(domain, { html = '', baseUrl, htmlAnalysis, fetcher = safeFetch, timeoutMs = FAVICON_FETCH_TIMEOUT_MS } = {}) {
     const headers = whoisleuthRequestHeaders();
-    const candidates = buildFaviconCandidates(domain, html);
+    const candidates = buildFaviconCandidates(domain, html, {
+        ...(baseUrl !== undefined ? { baseUrl } : {}),
+        ...(htmlAnalysis ? { htmlAnalysis } : {}),
+    });
     const requestTimeoutMs = Number.isInteger(timeoutMs) && timeoutMs >= 10 && timeoutMs <= FAVICON_FETCH_TIMEOUT_MS
         ? timeoutMs
         : FAVICON_FETCH_TIMEOUT_MS;
     for (const url of candidates) {
         // eslint-disable-next-line no-await-in-loop
         const bytes = await fetchFaviconBytes(url, headers, fetcher, requestTimeoutMs);
-        if (bytes) {
+        if (bytes && isFaviconImage(bytes)) {
             return {
                 hash: crypto.createHash('sha256').update(bytes).digest('hex'),
                 phash: faviconPerceptualHash(bytes),

package/lib/generated/cisa-kev-catalog.mjs

@@ -1,9 +1,9 @@
 // Generated by tools/cisa-kev-catalog.mts from the pinned CISA KEV feed.
 // United States Government work; do not edit by hand.
 const CISA_KEV_CATALOG = Object.freeze({
-    catalogVersion: "2026.08.31",
-    releasedAt: "2026-08-31T14:55:13.3856Z",
-    sourceSha256: "2043ec4073019154e781f687359bfd9759e4d1ca9a18befc99fbe0c4c93bbde8",
+    catalogVersion: "2026.10.02",
+    releasedAt: "2026-10-02T15:19:38.2945Z",
+    sourceSha256: "d2c8c6cb23291b46ff2b086197641a6b1fa35e6b746bba714cc280a1778f9e48",
     sourceUrl: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
     identifiers: Object.freeze([
         "CVE-2002-0367",
@@ -1439,6 +1439,7 @@ const CISA_KEV_CATALOG = Object.freeze({
         "CVE-2025-24991",
         "CVE-2025-24993",
         "CVE-2025-25181",
+        "CVE-2025-25249",
         "CVE-2025-25257",
         "CVE-2025-26399",
         "CVE-2025-26633",
@@ -1484,6 +1485,8 @@ const CISA_KEV_CATALOG = Object.freeze({
         "CVE-2025-38352",
         "CVE-2025-3928",
         "CVE-2025-3935",
+        "CVE-2025-39682",
+        "CVE-2025-39964",
         "CVE-2025-4008",
         "CVE-2025-40536",
         "CVE-2025-40551",
@@ -1571,6 +1574,9 @@ const CISA_KEV_CATALOG = Object.freeze({
         "CVE-2026-0257",
         "CVE-2026-0300",
         "CVE-2026-0770",
+        "CVE-2026-102489",
+        "CVE-2026-102490",
+        "CVE-2026-104286",
         "CVE-2026-10520",
         "CVE-2026-11645",
         "CVE-2026-12569",
@@ -1584,7 +1590,9 @@ const CISA_KEV_CATALOG = Object.freeze({
         "CVE-2026-1731",
         "CVE-2026-18556",
         "CVE-2026-18577",
+        "CVE-2026-19490",
         "CVE-2026-20045",
+        "CVE-2026-20079",
         "CVE-2026-20122",
         "CVE-2026-20127",
         "CVE-2026-20128",
@@ -1644,6 +1652,8 @@ const CISA_KEV_CATALOG = Object.freeze({
         "CVE-2026-39987",
         "CVE-2026-41091",
         "CVE-2026-41940",
+        "CVE-2026-42016",
+        "CVE-2026-42018",
         "CVE-2026-42208",
         "CVE-2026-42271",
         "CVE-2026-42897",
@@ -1656,13 +1666,17 @@ const CISA_KEV_CATALOG = Object.freeze({
         "CVE-2026-48172",
         "CVE-2026-48282",
         "CVE-2026-48558",
+        "CVE-2026-48710",
         "CVE-2026-48907",
         "CVE-2026-48908",
         "CVE-2026-48939",
+        "CVE-2026-49869",
         "CVE-2026-50522",
         "CVE-2026-50751",
         "CVE-2026-5281",
+        "CVE-2026-53266",
         "CVE-2026-53362",
+        "CVE-2026-5430",
         "CVE-2026-54420",
         "CVE-2026-55040",
         "CVE-2026-55255",
@@ -1671,28 +1685,60 @@ const CISA_KEV_CATALOG = Object.freeze({
         "CVE-2026-56290",
         "CVE-2026-56291",
         "CVE-2026-58644",
+        "CVE-2026-58704",
         "CVE-2026-59310",
+        "CVE-2026-59822",
         "CVE-2026-60004",
         "CVE-2026-60137",
         "CVE-2026-63030",
         "CVE-2026-63077",
         "CVE-2026-64849",
         "CVE-2026-65400",
+        "CVE-2026-65660",
         "CVE-2026-66384",
+        "CVE-2026-67277",
+        "CVE-2026-67279",
         "CVE-2026-68820",
         "CVE-2026-6973",
+        "CVE-2026-71362",
         "CVE-2026-72529",
         "CVE-2026-72530",
+        "CVE-2026-7273",
         "CVE-2026-72898",
         "CVE-2026-73570",
         "CVE-2026-7473",
+        "CVE-2026-75650",
+        "CVE-2026-76460",
+        "CVE-2026-76461",
+        "CVE-2026-76504",
         "CVE-2026-8037",
         "CVE-2026-81578",
+        "CVE-2026-81963",
         "CVE-2026-82078",
+        "CVE-2026-82329",
+        "CVE-2026-83548",
+        "CVE-2026-83549",
         "CVE-2026-8398",
         "CVE-2026-8452",
+        "CVE-2026-84869",
+        "CVE-2026-85046",
+        "CVE-2026-85102",
+        "CVE-2026-85706",
+        "CVE-2026-85880",
+        "CVE-2026-86060",
+        "CVE-2026-86218",
+        "CVE-2026-86950",
+        "CVE-2026-87491",
+        "CVE-2026-87886",
+        "CVE-2026-87902",
+        "CVE-2026-88771",
+        "CVE-2026-88772",
         "CVE-2026-9082",
-        "CVE-2026-9198"
+        "CVE-2026-9198",
+        "CVE-2026-93616",
+        "CVE-2026-93952",
+        "CVE-2026-94127",
+        "CVE-2026-9586"
     ]),
 });
 export { CISA_KEV_CATALOG };