correctover-scan 3.3.1 → 3.3.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +14 -0
- package/index.js +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -22,9 +22,23 @@ the license change is not retroactive.
|
|
|
22
22
|
|
|
23
23
|
|
|
24
24
|
 [](https://datatracker.ietf.org/doc/draft-correctover-ccs/)
|
|
25
|
+
[](https://entropy.correctover.com)
|
|
26
|
+
[](https://entropy.correctover.com)
|
|
25
27
|
|
|
26
28
|
---
|
|
27
29
|
|
|
30
|
+
### New in v3.3.1 — weak-entropy (RNG) detection
|
|
31
|
+
|
|
32
|
+
The `entropy-rng` check (C2.4, critical) detects known weak-PRNG fingerprints in bundled code:
|
|
33
|
+
|
|
34
|
+
- **crypto-js 3.x constant-LCG** in `WordArray.random` (CVE-2026-71851, CVSS 9.0 — the Ill Bloom ~$5M theft root cause)
|
|
35
|
+
- **jsbn SecureRandom pool** (`Arcfour`/`rng_psize` — CVE-2026-73567 family, SM2 key recovery in 8–10s from public key + a 2-second time window)
|
|
36
|
+
- `Math.random` in key/salt/token/nonce semantic neighborhoods (word-boundary matched)
|
|
37
|
+
- timestamp-seeded tokens, Math.random-based UUID implementations
|
|
38
|
+
|
|
39
|
+
Keys generated by a weak RNG **do not heal when you upgrade the library** — they must be rotated.
|
|
40
|
+
Check whether *your* dependencies ship vulnerable key paths: **[free lockfile check, runs in your browser](https://entropy.correctover.com)** — nothing is uploaded.
|
|
41
|
+
|
|
28
42
|
### Verifiable artifacts behind this tool
|
|
29
43
|
|
|
30
44
|
- **Third-party interoperability** — joint assessment merged into the [EMILIA protocol](https://github.com/emiliaprotocol/emilia-protocol/pull/693)
|
package/index.js
CHANGED
|
@@ -15,7 +15,7 @@ const { recordCall, getUpgradeMessage } = require('./core/license');
|
|
|
15
15
|
const skillpay = require('./core/skillpay');
|
|
16
16
|
const { formatHTMLReport, normalizeConfigFindings, normalizeBundleFindings, failHint } = require('./core/report');
|
|
17
17
|
|
|
18
|
-
const VERSION = '3.3.
|
|
18
|
+
const VERSION = '3.3.2';
|
|
19
19
|
const PRODUCT = 'correctover-scan';
|
|
20
20
|
const JS_EXT = new Set(['.js', '.mjs', '.cjs', '.ts']);
|
|
21
21
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "correctover-scan",
|
|
3
|
-
"version": "3.3.
|
|
3
|
+
"version": "3.3.2",
|
|
4
4
|
"description": "Correctover Security Scanner — CCS audit for MCP configurations AND published JS bundles/npm packages. Detects hardcoded secrets, RCE, SSRF, credential hijacking against OWASP AISVS 1.0.",
|
|
5
5
|
"main": "index.js",
|
|
6
6
|
"bin": {
|