blitzstrike 2.4.34 → 2.4.35

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.35] — 2026-09-14
+
+### Added — Variant Mining (confirm once, weaponize everywhere)
+
+- New `src/variant-scan.ts`: mass-scan an install base (plugin/theme/repo tree)
+  with ALL detectors (taint, complex-bugs incl. wrong-context sanitization +
+  missing authz/nonce, route-confusion) and report hits grouped by a DERIVED
+  signature (`<detector>:<type>`).
+- New `variant_scan` tool: pass `signature` to mine for ONE bug family — the
+  pattern that turns one confirmed CVE into hundreds of variants across 10k+
+  files.
+
 ## [2.4.34] — 2026-09-14
 
 ### Added — Framework Security Knowledge Graph (WordPress authz/nonce)

package/dist/index.js

@@ -15493,7 +15493,7 @@ async function checkMcpServers() {
 var init_mcp_status = () => {};
 
 // src/sync.ts
-import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, readFileSync as readFileSync20, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, readFileSync as readFileSync21, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
 import { join as join19 } from "node:path";
 import { homedir as homedir10 } from "node:os";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
@@ -15589,7 +15589,7 @@ function manualCopy(src, dst) {
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync8(d, readFileSync20(s));
+      writeFileSync8(d, readFileSync21(s));
   }
 }
 var ROOT7, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
@@ -15640,7 +15640,7 @@ var init_update = __esm(() => {
 });
 
 // src/release.ts
-import { readFileSync as readFileSync22, existsSync as existsSync12 } from "node:fs";
+import { readFileSync as readFileSync23, existsSync as existsSync12 } from "node:fs";
 import { join as join20 } from "node:path";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
 import { execSync as execSync2 } from "node:child_process";
@@ -15648,7 +15648,7 @@ function validateRelease() {
   const checks = [];
   checks.push({ name: "package.json version", ok: true, detail: VERSION });
   try {
-    const changelog = readFileSync22(join20(ROOT8, "CHANGELOG.md"), "utf8");
+    const changelog = readFileSync23(join20(ROOT8, "CHANGELOG.md"), "utf8");
     const m = changelog.match(/^##\s+\[([0-9]+\.[0-9]+\.[0-9]+)\]/m);
     const changelogVersion = m?.[1] ?? null;
     checks.push({
@@ -15689,13 +15689,13 @@ var init_release = __esm(() => {
 });
 
 // src/dependency.ts
-import { readFileSync as readFileSync23 } from "node:fs";
+import { readFileSync as readFileSync24 } from "node:fs";
 import { join as join21 } from "node:path";
 import { fileURLToPath as fileURLToPath11 } from "node:url";
 function checkDependencies() {
   let pkg = {};
   try {
-    pkg = JSON.parse(readFileSync23(join21(ROOT9, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync24(join21(ROOT9, "package.json"), "utf8"));
   } catch {
     return { install_scripts: [], git_dependencies: [], total_dependencies: 0, safe: false };
   }
@@ -15722,7 +15722,7 @@ var init_dependency = __esm(() => {
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync24, existsSync as existsSync13, writeFileSync as writeFileSync9, mkdirSync as mkdirSync10 } from "node:fs";
+import { readFileSync as readFileSync25, existsSync as existsSync13, writeFileSync as writeFileSync9, mkdirSync as mkdirSync10 } from "node:fs";
 import { join as join22, dirname as dirname2 } from "node:path";
 import { homedir as homedir11 } from "node:os";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
@@ -15833,7 +15833,7 @@ function resolveCommand() {
 }
 function readJson(p) {
   try {
-    return JSON.parse(readFileSync24(p, "utf8"));
+    return JSON.parse(readFileSync25(p, "utf8"));
   } catch {
     return null;
   }
@@ -15876,7 +15876,7 @@ function copyOpenCodeAgents() {
     const src = join22(srcDir, f);
     const dst = join22(dstDir, f);
     if (existsSync13(src)) {
-      writeFileSync9(dst, readFileSync24(src, "utf8"));
+      writeFileSync9(dst, readFileSync25(src, "utf8"));
     }
   }
 }
@@ -15885,7 +15885,7 @@ function codexWrite(p) {
     const dir = dirname2(p);
     if (!existsSync13(dir))
       mkdirSync10(dir, { recursive: true });
-    let existing = existsSync13(p) ? readFileSync24(p, "utf8") : "";
+    let existing = existsSync13(p) ? readFileSync25(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -15904,7 +15904,7 @@ function hermesWrite(p) {
     const dir = dirname2(p);
     if (!existsSync13(dir))
       mkdirSync10(dir, { recursive: true });
-    let existing = existsSync13(p) ? readFileSync24(p, "utf8") : "";
+    let existing = existsSync13(p) ? readFileSync25(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -30754,7 +30754,7 @@ class StdioServerTransport {
 
 // src/server.ts
 init_scanner();
-import { readFileSync as readFileSync21 } from "node:fs";
+import { readFileSync as readFileSync22 } from "node:fs";
 
 // src/recon.ts
 var TIMEOUT_MS = 25000;
@@ -57054,8 +57054,85 @@ function openCount() {
   return loadObligations().filter((o) => o.status === "open").length;
 }
 
+// src/variant-scan.ts
+init_scanner();
+import { readFileSync as readFileSync19 } from "node:fs";
+function deriveSignature(detector, type) {
+  return `${detector}:${type}`;
+}
+function variantScan(root, opts = {}) {
+  const files = iterSourceFiles(root, opts.maxFiles ?? 5000);
+  const hits = [];
+  for (const file of files) {
+    let code;
+    try {
+      code = readFileSync19(file, "utf8");
+    } catch {
+      continue;
+    }
+    try {
+      const taint = analyzeTaint(file);
+      for (const f of taint.findings) {
+        const type = f.category ?? f.sink ?? "taint";
+        hits.push({
+          file,
+          detector: "taint",
+          type,
+          signature: deriveSignature("taint", type),
+          line: f.sink_line ?? 0,
+          severity: "high",
+          evidence: f.sink ?? ""
+        });
+      }
+    } catch {}
+    for (const f of detectComplexBugs(code, file)) {
+      hits.push({
+        file,
+        detector: "complex_bugs",
+        type: f.type,
+        signature: deriveSignature("complex_bugs", f.type),
+        line: f.line,
+        severity: f.severity,
+        evidence: f.evidence
+      });
+    }
+    for (const f of detectRouteConfusion(code, file)) {
+      hits.push({
+        file,
+        detector: "route_confusion",
+        type: f.type,
+        signature: deriveSignature("route_confusion", f.type),
+        line: f.line,
+        severity: f.severity,
+        evidence: f.evidence
+      });
+    }
+  }
+  const bySignature = {};
+  for (const h of hits)
+    bySignature[h.signature] = (bySignature[h.signature] ?? 0) + 1;
+  const filtered = opts.signature ? hits.filter((h) => h.signature === opts.signature) : hits;
+  const filesWithFindings = new Set(filtered.map((h) => h.file));
+  return {
+    root,
+    files_scanned: files.length,
+    files_with_findings: filesWithFindings.size,
+    total_findings: filtered.length,
+    signature: opts.signature ?? null,
+    by_signature: bySignature,
+    hits: filtered.map((h) => ({
+      file: h.file,
+      detector: h.detector,
+      type: h.type,
+      signature: h.signature,
+      line: h.line,
+      severity: h.severity
+    }))
+  };
+}
+
 // src/enterprise-benchmark.ts
-import { existsSync as existsSync11, readFileSync as readFileSync19, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync20, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
 import { join as join18, resolve } from "node:path";
 var ROOT6 = resolve(process.cwd(), "bench", "enterprise");
 var ENTERPRISE_FIXTURES = [
@@ -57097,7 +57174,7 @@ function detectFixture(dir) {
   for (const f of sourceFiles(dir)) {
     let code;
     try {
-      code = readFileSync19(f, "utf8");
+      code = readFileSync20(f, "utf8");
     } catch {
       continue;
     }
@@ -58008,6 +58085,17 @@ ${statusLine}` : statusLine },
     const k = frameworkKnowledge(framework ?? "wordpress");
     return { content: [{ type: "text", text: JSON.stringify(k ?? { error: "framework not in the knowledge graph", framework }) }] };
   });
+  server.registerTool("variant_scan", {
+    title: "Mass variant-mining scan of an install base",
+    description: "VARIANT-MINING: mass-scan a source tree (plugin/theme/repo install base) with ALL detectors (taint, complex-bugs incl. wrong-context sanitization + missing authz/nonce, route-confusion) and report hits grouped by DERIVED signature (<detector>:<type>). Pass `signature` to mine for ONE bug family (e.g. complex_bugs:missing_authz) — the 'confirm once, weaponize everywhere' pattern that turns one CVE into hundreds of variants across an install base.",
+    inputSchema: {
+      root: string2().describe("Root directory to scan"),
+      max_files: number2().optional().describe("Max files to scan (default 5000)"),
+      signature: string2().optional().describe("Filter to one bug family (e.g. complex_bugs:missing_authz)")
+    }
+  }, async ({ root, max_files, signature }) => {
+    return { content: [{ type: "text", text: JSON.stringify(variantScan(root, { maxFiles: max_files, signature })) }] };
+  });
   server.registerTool("payload_lookup", {
     title: "Look up exploit payloads",
     description: "INTEL: find a payload collection (66 categories from PayloadsAllTheThings).",
@@ -58546,7 +58634,7 @@ ${statusLine}` : statusLine },
     description: "Route confusion (separate class from source→sink taint): detect attacker-controlled dispatch (call_user_func/forward/dispatch), dynamic method calls ($obj->$m()), dynamic include (LFI), batch/proxy forwarding without per-route auth re-check, and route matching without path normalization.",
     inputSchema: { path: string2().describe("Source file path (PHP)") }
   }, async ({ path }) => {
-    const code = readFileSync21(path, "utf8");
+    const code = readFileSync22(path, "utf8");
     const findings = detectRouteConfusion(code, path);
     return {
       content: [{
@@ -58560,7 +58648,7 @@ ${statusLine}` : statusLine },
     description: "Complex-bug detection beyond taint: deserialization→POP gadget chain (unserialize + magic method), type juggling (loose ==/!= vs hash/secret), mass assignment (extract/parse_str without a safe flag), prototype pollution (unsafe merge of request data), CRLF/header injection (user input into a header), path confusion (user input into a file path without canonicalization), SSRF (user-controlled URL with no host allowlist), XXE (user XML parsed without disabling entities), SSTI (user input into a template render with no sandbox), wrong-context sanitization (sanitize_text_field() into a SQL query), and missing authorization/nonce on WordPress entry points (wp_ajax_* / admin_post_* / register_rest_route without current_user_can, nonce verification, or permission_callback).",
     inputSchema: { path: string2().describe("Source file path") }
   }, async ({ path }) => {
-    const code = readFileSync21(path, "utf8");
+    const code = readFileSync22(path, "utf8");
     const findings = detectComplexBugs(code, path);
     return {
       content: [{
@@ -58627,7 +58715,7 @@ ${statusLine}` : statusLine },
     let lang = language;
     if (path && !code) {
       try {
-        src = readFileSync21(path, "utf8");
+        src = readFileSync22(path, "utf8");
       } catch {
         return { content: [{ type: "text", text: JSON.stringify({ error: `cannot read ${path}` }) }] };
       }
@@ -58868,7 +58956,7 @@ async function serve() {
 
 // src/index.ts
 init_cli();
-import { readFileSync as readFileSync25, existsSync as existsSync14 } from "node:fs";
+import { readFileSync as readFileSync26, existsSync as existsSync14 } from "node:fs";
 import { join as join23 } from "node:path";
 import { fileURLToPath as fileURLToPath13 } from "node:url";
 var ROOT11 = join23(fileURLToPath13(new URL(".", import.meta.url)), "..");
@@ -58876,7 +58964,7 @@ function readVersion() {
   try {
     const p = join23(ROOT11, "package.json");
     if (existsSync14(p))
-      return JSON.parse(readFileSync25(p, "utf8")).version ?? "1.0.0";
+      return JSON.parse(readFileSync26(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.34",
+  "version": "2.4.35",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {