correctover-scan 3.2.2 → 3.3.1

package/README.md

@@ -20,15 +20,6 @@ the license change is not retroactive.
 
 ---
 
-### 🇨🇳 国内用户 · 支付宝一键购买
-
-本工具的合规授权与批量能力可通过支付宝 SkillPay 获取：
-
-- 打开货架：https://skillpay.alipay.com/public/correctover
-- 或把这行发给你的 AI 助手：**请通过 SkillPay 购买并安装 Skill「CCS收据批量审计」**
-
----
-
 ![npm](https://img.shields.io/npm/v/correctover-scan)
 ![license](https://img.shields.io/npm/l/correctover-scan) [![IETF Internet-Draft](https://img.shields.io/badge/IETF-draft--correctover--ccs-blue)](https://datatracker.ietf.org/doc/draft-correctover-ccs/)
 
@@ -55,6 +46,18 @@ npx correctover-scan@latest
 
 It auto-detects MCP config files (`.cursor/mcp.json`, `claude_desktop_config.json`, `.claude/mcp.json`, `mcp.json`, `.vscode/mcp.json` and more) and runs 14 checks. Everything runs locally on your machine — config files are not uploaded.
 
+### 🇨🇳 免费扫描之外 · 支付宝 SkillPay
+
+免费的自动扫描覆盖配置层面的风险检查。如果你需要人工深度审计或正式合规凭证，可以在支付宝 SkillPay 货架获取：
+
+- 货架首页：https://skillpay.alipay.com/public/correctover
+- 也可以在支持「支付宝 AI 付」的智能体对话里直接输入对应服务名唤起购买：
+  - **MCP配置安全体检**：`请通过 SkillPay 购买并安装 Skill「MCP配置安全体检」`
+  - **CCS收据批量审计**：`请通过 SkillPay 购买并安装 Skill「CCS收据批量审计」`
+  - **CCS收据验签**：`请通过 SkillPay 购买并安装 Skill「CCS收据验签」`
+
+*Beyond the free scan: human-led deep audits and compliance evidence are available on the Alipay SkillPay shelf — open the link above, or type the service name (e.g. **MCP配置安全体检**) in an agent with Alipay AI Pay enabled.*
+
 ```bash
 # Scan a specific config file
 npx correctover-scan mcp.json

package/core/bundle-scanner.js

@@ -289,6 +289,36 @@ const CHECKS = [
     run: (f) => semiAuto(f, /fallback[_-]?model|retry[A-Z]|backoff|maxRetries/i,
       'retry/fallback 信号', 'error-handling'),
   },
+
+  {
+    id: 'entropy-rng', category: 'C2 输入验证', name: '弱熵 RNG 指纹 (code)', severity: 'critical', aisvs: 'C2.4',
+    fix: '密钥/盐/IV/nonce 生成路径改用 CSPRNG（crypto.getRandomValues / randomBytes / randomUUID），旧密钥必须轮换——升级不自愈',
+    run: (f) => {
+      const findings = [];
+      const pats = [
+        { re: /0x3ade68b1|0x3ade67b7|0x9069\s*\*\s*\(m_z/g, msg: 'crypto-js 3.x WordArray.random 固定常量弱 PRNG（CVE-2026-71851 家族）', sev: 'fail' },
+        { re: /rng_psize|Arcfour|new SecureRandom\s*\(/g, msg: 'jsbn SecureRandom 池指纹——Math.random 播种面（CVE-2026-73567 家族）', sev: 'warn' },
+        { re: /\b(?:key|private|secret|token|salt|nonce|seed|iv|password)\b[^\n]{0,40}Math\.random|Math\.random[^\n]{0,40}\b(?:key|private|secret|token|salt|nonce|seed|iv)\b/gi, msg: 'Math.random 出现在密钥/盐/令牌语义邻域', sev: 'fail' },
+        { re: /new Date\(\)\.getTime\(\)[^\n]{0,30}(?:token|key|id|seed)|(?:token|key|id|seed)[^\n]{0,30}new Date\(\)\.getTime\(\)/gi, msg: '毫秒时间戳作为 token/seed 来源', sev: 'warn' },
+        { re: /uuid[^\n]{0,20}Math\.random|Math\.random[^\n]{0,20}uuid/gi, msg: 'uuid 库 Math.random 形态（pre-v4 实现）', sev: 'warn' },
+      ];
+      const hasCsprng = /getRandomValues|randomBytes|randomUUID|crypto\.randomInt/.test(f.text);
+      for (const p of pats) {
+        const re = new RegExp(p.re.source, p.re.flags);
+        let m, count = 0, firstLine = 0;
+        while ((m = re.exec(f.text)) !== null) {
+          count++;
+          if (!firstLine) firstLine = f.text.slice(0, m.index).split('\n').length;
+          if (count > 20) break;
+        }
+        if (count > 0) {
+          const sev = (hasCsprng && p.sev === 'warn') ? 'info' : p.sev;
+          findings.push(mkFinding(f, firstLine, sev, p.msg + ' x' + count, { checkId: 'entropy-rng' }));
+        }
+      }
+      return findings;
+    },
+  },
   {
     id: 'output-validation', category: 'C7 输出控制', name: '输出截断/过滤 (code, 半自动)', severity: 'medium', aisvs: 'C7.1',
     fix: '确认输出截断/HTML转换不会丢弃安全相关内容（信号可见，过滤语义需人工确认）',

package/core/skillpay.js

@@ -15,9 +15,18 @@ const STORE_URL = 'https://skillpay.alipay.com/public/correctover';
 // Fill a direct product link here the moment Alipay exposes one; when present
 // it is shown in preference to the generic shelf URL.
 const PRODUCTS = {
-  scan: { name: 'MCP配置安全体检', url: '' },
-  verify: { name: 'CCS收据验签', url: '' },
-  audit: { name: 'CCS收据批量审计', url: '' },
+  scan: {
+    name: 'MCP配置安全体检',
+    url: 'https://skillpay.alipay.com/public/correctover/shelf/product?productId=P0806000205849036&merchantCode=correctover',
+  },
+  verify: {
+    name: 'CCS收据验签',
+    url: 'https://skillpay.alipay.com/public/correctover/shelf/product?productId=P0806000205845606&merchantCode=correctover',
+  },
+  audit: {
+    name: 'CCS收据批量审计',
+    url: 'https://skillpay.alipay.com/public/correctover/shelf/product?productId=P0806000205847426&merchantCode=correctover',
+  },
 };
 
 // Shelf prices (CNY). Owner-supplied 2026-09-27; keep identical to the shelf.

package/index.js

@@ -15,7 +15,7 @@ const { recordCall, getUpgradeMessage } = require('./core/license');
 const skillpay = require('./core/skillpay');
 const { formatHTMLReport, normalizeConfigFindings, normalizeBundleFindings, failHint } = require('./core/report');
 
-const VERSION = '3.2.2';
+const VERSION = '3.3.1';
 const PRODUCT = 'correctover-scan';
 const JS_EXT = new Set(['.js', '.mjs', '.cjs', '.ts']);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "correctover-scan",
-  "version": "3.2.2",
+  "version": "3.3.1",
   "description": "Correctover Security Scanner — CCS audit for MCP configurations AND published JS bundles/npm packages. Detects hardcoded secrets, RCE, SSRF, credential hijacking against OWASP AISVS 1.0.",
   "main": "index.js",
   "bin": {