blitzstrike 2.4.67 → 2.4.69
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +39 -0
- package/dist/index.js +423 -103
- package/intelligence/cwe_map.json +321 -63
- package/intelligence/patterns.json +511 -100
- package/intelligence/variants.json +28 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,45 @@ All notable changes to Blitz Strike are documented here.
|
|
|
5
5
|
The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/).
|
|
7
7
|
|
|
8
|
+
## [2.4.69] — 2026-09-14
|
|
9
|
+
|
|
10
|
+
### Added — Supply-chain detectors (dependency confusion + ML model loading)
|
|
11
|
+
|
|
12
|
+
- New `dependency_confusion` detector (CWE-427): flags a manifest/build file that
|
|
13
|
+
resolves a package from a PUBLIC registry (--index-url/--extra-index-url to
|
|
14
|
+
pypi.org/npmjs.org/rubygems.org), or references a scoped internal package
|
|
15
|
+
(@company/pkg) with no private registry pinned — the squattable-name confusion
|
|
16
|
+
vector. Manifest-gated by file name.
|
|
17
|
+
- New `ml_supply_chain` detector (CWE-502): flags untrusted AI/ML model loading —
|
|
18
|
+
`torch.load` without `weights_only=True`, `joblib.load`, `keras.models.load_model`,
|
|
19
|
+
and `np.load(allow_pickle=True)` (source-agnostic, the flag IS the signal) —
|
|
20
|
+
pickle RCE on load. Complementary to the deserialization detector.
|
|
21
|
+
- Wired into the full pipeline: CWE map (now 64), patterns (22), variants (74, all
|
|
22
|
+
fired), synonyms (69 aliases), severity VRT map, verification harness (now 21/21
|
|
23
|
+
detectors TP+TN).
|
|
24
|
+
- FIXED a severity gap the interconnection audit exposed: the VRT map was missing
|
|
25
|
+
the 4 modern detectors added earlier (llm_injection, graphql_exposure,
|
|
26
|
+
oauth_misconfig, grpc_reflection) — they now carry proper VRT tiers, and a new
|
|
27
|
+
regression test asserts every detector type has a non-"unclassified" severity.
|
|
28
|
+
|
|
29
|
+
## [2.4.68] — 2026-09-14
|
|
30
|
+
|
|
31
|
+
### Added — Git-history secret mining + leaked-key validation
|
|
32
|
+
|
|
33
|
+
- New `scan_git_history` tool: mine a repo's HISTORY (not just HEAD) for secrets in
|
|
34
|
+
files that were DELETED — the "removed later != fixed" trap. Runs
|
|
35
|
+
`git log --diff-filter=D` + `git show <sha>^:<path>` (read-only) and feeds every
|
|
36
|
+
recovered pre-deletion blob through the hardcoded_secret detector, with the
|
|
37
|
+
deletion commit + message attached. Also a pickaxe mode (git log -S) to trace one
|
|
38
|
+
specific token through all commits.
|
|
39
|
+
- New `validate_leaked_key` tool: prove a recovered credential is still ACTIVE on a
|
|
40
|
+
live API with a READ-ONLY differential test — the same endpoint is fetched
|
|
41
|
+
without the key (expect 401/403) and with the key (expect 200); the contrast is
|
|
42
|
+
proof of auth bypass. Accepts a raw key or a blobUrl + varName to fetch/parse it.
|
|
43
|
+
- Secret severity now ESCALATES: when a secret-field literal also matches a known
|
|
44
|
+
format (e.g. a Stripe live key under a SECRET_KEY field), the finding takes the
|
|
45
|
+
format's more precise severity (critical) instead of the generic field tier.
|
|
46
|
+
|
|
8
47
|
## [2.4.67] — 2026-09-14
|
|
9
48
|
|
|
10
49
|
### Fixed — Whole-code interconnection audit (2 bugs)
|