blitzstrike 2.4.67 → 2.4.69

package/intelligence/variants.json

@@ -1,7 +1,7 @@
 {
   "$schema": "blitzstrike-variants-v1",
   "version": "1.0.0",
-  "_comment": "Variant corpus \u2014 concrete real-world code shapes per detector class. Each variant is a shape that MUST fire its class's detector. The verification harness sweeps every variant and reports per-class coverage, so a detector that misses a shape surfaces as a false negative. Shapes are generic (language-idiomatic), with no vendor/product framing.",
+  "_comment": "Variant corpus — concrete real-world code shapes per detector class. Each variant is a shape that MUST fire its class's detector. The verification harness sweeps every variant and reports per-class coverage, so a detector that misses a shape surfaces as a false negative. Shapes are generic (language-idiomatic), with no vendor/product framing.",
   "variants": [
     {
       "class": "sql_injection",
@@ -347,6 +347,33 @@
       "class": "grpc_reflection",
       "code": "grpc_reflection_v1.ReflectionServicer.to_server(server)",
       "note": "reflection to server"
+    },
+    {
+      "class": "dependency_confusion",
+      "code": "--extra-index-url https://pypi.org/simple",
+      "note": "public PyPI as extra-index (classic confusion vector)",
+      "file": "requirements.txt"
+    },
+    {
+      "class": "dependency_confusion",
+      "code": "\"@company/internal-lib\": \"^1.0.0\"",
+      "note": "scoped internal package, no private registry",
+      "file": "package.json"
+    },
+    {
+      "class": "ml_supply_chain",
+      "code": "model = torch.load(download_path)",
+      "note": "torch.load without weights_only"
+    },
+    {
+      "class": "ml_supply_chain",
+      "code": "clf = joblib.load(uploaded_file)",
+      "note": "joblib.load on an upload"
+    },
+    {
+      "class": "ml_supply_chain",
+      "code": "arr = np.load(path, allow_pickle=True)",
+      "note": "np.load allow_pickle=True"
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.67",
+  "version": "2.4.69",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {