correctover-scan 3.2.3 → 3.3.1

package/core/bundle-scanner.js

@@ -289,6 +289,36 @@ const CHECKS = [
     run: (f) => semiAuto(f, /fallback[_-]?model|retry[A-Z]|backoff|maxRetries/i,
       'retry/fallback 信号', 'error-handling'),
   },
+
+  {
+    id: 'entropy-rng', category: 'C2 输入验证', name: '弱熵 RNG 指纹 (code)', severity: 'critical', aisvs: 'C2.4',
+    fix: '密钥/盐/IV/nonce 生成路径改用 CSPRNG（crypto.getRandomValues / randomBytes / randomUUID），旧密钥必须轮换——升级不自愈',
+    run: (f) => {
+      const findings = [];
+      const pats = [
+        { re: /0x3ade68b1|0x3ade67b7|0x9069\s*\*\s*\(m_z/g, msg: 'crypto-js 3.x WordArray.random 固定常量弱 PRNG（CVE-2026-71851 家族）', sev: 'fail' },
+        { re: /rng_psize|Arcfour|new SecureRandom\s*\(/g, msg: 'jsbn SecureRandom 池指纹——Math.random 播种面（CVE-2026-73567 家族）', sev: 'warn' },
+        { re: /\b(?:key|private|secret|token|salt|nonce|seed|iv|password)\b[^\n]{0,40}Math\.random|Math\.random[^\n]{0,40}\b(?:key|private|secret|token|salt|nonce|seed|iv)\b/gi, msg: 'Math.random 出现在密钥/盐/令牌语义邻域', sev: 'fail' },
+        { re: /new Date\(\)\.getTime\(\)[^\n]{0,30}(?:token|key|id|seed)|(?:token|key|id|seed)[^\n]{0,30}new Date\(\)\.getTime\(\)/gi, msg: '毫秒时间戳作为 token/seed 来源', sev: 'warn' },
+        { re: /uuid[^\n]{0,20}Math\.random|Math\.random[^\n]{0,20}uuid/gi, msg: 'uuid 库 Math.random 形态（pre-v4 实现）', sev: 'warn' },
+      ];
+      const hasCsprng = /getRandomValues|randomBytes|randomUUID|crypto\.randomInt/.test(f.text);
+      for (const p of pats) {
+        const re = new RegExp(p.re.source, p.re.flags);
+        let m, count = 0, firstLine = 0;
+        while ((m = re.exec(f.text)) !== null) {
+          count++;
+          if (!firstLine) firstLine = f.text.slice(0, m.index).split('\n').length;
+          if (count > 20) break;
+        }
+        if (count > 0) {
+          const sev = (hasCsprng && p.sev === 'warn') ? 'info' : p.sev;
+          findings.push(mkFinding(f, firstLine, sev, p.msg + ' x' + count, { checkId: 'entropy-rng' }));
+        }
+      }
+      return findings;
+    },
+  },
   {
     id: 'output-validation', category: 'C7 输出控制', name: '输出截断/过滤 (code, 半自动)', severity: 'medium', aisvs: 'C7.1',
     fix: '确认输出截断/HTML转换不会丢弃安全相关内容（信号可见，过滤语义需人工确认）',

package/index.js

@@ -15,7 +15,7 @@ const { recordCall, getUpgradeMessage } = require('./core/license');
 const skillpay = require('./core/skillpay');
 const { formatHTMLReport, normalizeConfigFindings, normalizeBundleFindings, failHint } = require('./core/report');
 
-const VERSION = '3.2.2';
+const VERSION = '3.3.1';
 const PRODUCT = 'correctover-scan';
 const JS_EXT = new Set(['.js', '.mjs', '.cjs', '.ts']);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "correctover-scan",
-  "version": "3.2.3",
+  "version": "3.3.1",
   "description": "Correctover Security Scanner — CCS audit for MCP configurations AND published JS bundles/npm packages. Detects hardcoded secrets, RCE, SSRF, credential hijacking against OWASP AISVS 1.0.",
   "main": "index.js",
   "bin": {