@webdecoy/fcaptcha 1.0.1 → 1.0.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/fcaptcha",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Open source CAPTCHA with PoW, bot detection, and Vision AI protection",
   "main": "index.js",
   "exports": {

package/server.js

@@ -42,13 +42,11 @@ const powChallengeStore = {
     };
 
     // Sign the challenge
-    const sig = crypto.createHmac('sha256', SECRET_KEY)
+    challengeData.sig = crypto.createHmac('sha256', SECRET_KEY)
       .update(JSON.stringify(challengeData))
       .digest('hex')
       .slice(0, 16);
 
-    challengeData.sig = sig;
-
     // Store challenge
     this.challenges.set(challengeId, {
       ...challengeData,
@@ -187,7 +185,8 @@ const WEIGHTS = {
   vision_ai: 0.15,
   headless: 0.15,
   automation: 0.10,
-  behavioral: 0.20,
+  cdp: 0.12,
+  behavioral: 0.18,
   fingerprint: 0.10,
   rate_limit: 0.05,
   datacenter: 0.10,
@@ -383,6 +382,46 @@ function detectAutomation(signals) {
   return detections;
 }
 
+function detectCDP(signals) {
+  const detections = [];
+  const env = signals.environmental || {};
+  const cdp = env.cdp || {};
+
+  if (cdp.detected) {
+    const signalList = cdp.signals || [];
+    const signalCount = signalList.length;
+
+    // High-confidence signals
+    const highConfSignals = ['chromedriver_cdc', 'puppeteer_eval', 'cdp_script_injection'];
+    const hasHighConf = signalList.some(s => highConfSignals.includes(s));
+
+    if (hasHighConf) {
+      detections.push({
+        category: 'cdp',
+        score: 0.9,
+        confidence: 0.95,
+        reason: `CDP automation detected: ${signalList.join(', ')}`
+      });
+    } else if (signalCount >= 2) {
+      detections.push({
+        category: 'cdp',
+        score: 0.8,
+        confidence: 0.85,
+        reason: `Multiple CDP indicators: ${signalList.join(', ')}`
+      });
+    } else if (signalCount === 1) {
+      detections.push({
+        category: 'cdp',
+        score: 0.6,
+        confidence: 0.7,
+        reason: `CDP indicator: ${signalList.join(', ')}`
+      });
+    }
+  }
+
+  return detections;
+}
+
 function detectBehavioral(signals) {
   const detections = [];
   const b = signals.behavioral || {};
@@ -585,8 +624,7 @@ function generateToken(ip, siteKey, score) {
   };
 
   const payload = JSON.stringify(data, Object.keys(data).sort());
-  const sig = crypto.createHmac('sha256', SECRET_KEY).update(payload).digest('hex').slice(0, 16);
-  data.sig = sig;
+  data.sig = crypto.createHmac('sha256', SECRET_KEY).update(payload).digest('hex').slice(0, 16);
 
   return Buffer.from(JSON.stringify(data)).toString('base64url');
 }
@@ -626,6 +664,7 @@ function runVerification(signals, ip, siteKey, userAgent, headers = {}, ja3Hash
     ...detectVisionAI(signals),
     ...detectHeadless(signals, userAgent),
     ...detectAutomation(signals),
+    ...detectCDP(signals),
     ...detectBehavioral(signals),
     ...detectFingerprint(signals, ip, siteKey),
     ...detectRateAbuse(ip, siteKey)