correctover-scan 3.3.1 → 3.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +14 -0
- package/core/bundle-scanner.js +1 -0
- package/index.js +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -22,9 +22,23 @@ the license change is not retroactive.
|
|
|
22
22
|
|
|
23
23
|
|
|
24
24
|
 [](https://datatracker.ietf.org/doc/draft-correctover-ccs/)
|
|
25
|
+
[](https://entropy.correctover.com)
|
|
26
|
+
[](https://entropy.correctover.com)
|
|
25
27
|
|
|
26
28
|
---
|
|
27
29
|
|
|
30
|
+
### New in v3.3.1 — weak-entropy (RNG) detection
|
|
31
|
+
|
|
32
|
+
The `entropy-rng` check (C2.4, critical) detects known weak-PRNG fingerprints in bundled code:
|
|
33
|
+
|
|
34
|
+
- **crypto-js 3.x constant-LCG** in `WordArray.random` (CVE-2026-71851, CVSS 9.0 — the Ill Bloom ~$5M theft root cause)
|
|
35
|
+
- **jsbn SecureRandom pool** (`Arcfour`/`rng_psize` — CVE-2026-73567 family, SM2 key recovery in 8–10s from public key + a 2-second time window)
|
|
36
|
+
- `Math.random` in key/salt/token/nonce semantic neighborhoods (word-boundary matched)
|
|
37
|
+
- timestamp-seeded tokens, Math.random-based UUID implementations
|
|
38
|
+
|
|
39
|
+
Keys generated by a weak RNG **do not heal when you upgrade the library** — they must be rotated.
|
|
40
|
+
Check whether *your* dependencies ship vulnerable key paths: **[free lockfile check, runs in your browser](https://entropy.correctover.com)** — nothing is uploaded.
|
|
41
|
+
|
|
28
42
|
### Verifiable artifacts behind this tool
|
|
29
43
|
|
|
30
44
|
- **Third-party interoperability** — joint assessment merged into the [EMILIA protocol](https://github.com/emiliaprotocol/emilia-protocol/pull/693)
|
package/core/bundle-scanner.js
CHANGED
|
@@ -299,6 +299,7 @@ const CHECKS = [
|
|
|
299
299
|
{ re: /0x3ade68b1|0x3ade67b7|0x9069\s*\*\s*\(m_z/g, msg: 'crypto-js 3.x WordArray.random 固定常量弱 PRNG（CVE-2026-71851 家族）', sev: 'fail' },
|
|
300
300
|
{ re: /rng_psize|Arcfour|new SecureRandom\s*\(/g, msg: 'jsbn SecureRandom 池指纹——Math.random 播种面（CVE-2026-73567 家族）', sev: 'warn' },
|
|
301
301
|
{ re: /\b(?:key|private|secret|token|salt|nonce|seed|iv|password)\b[^\n]{0,40}Math\.random|Math\.random[^\n]{0,40}\b(?:key|private|secret|token|salt|nonce|seed|iv)\b/gi, msg: 'Math.random 出现在密钥/盐/令牌语义邻域', sev: 'fail' },
|
|
302
|
+
{ re: /function\s+[a-zA-Z0-9_]*(?:[Kk]ey|[Ss]eed|[Tt]oken|[Nn]once)[a-zA-Z0-9_]*\s*\([^)]*\)\s*\{[^}]*Math\.random/g, msg: 'Math.random 在密钥/token 生成函数体内（函数名语义）', sev: 'fail' },
|
|
302
303
|
{ re: /new Date\(\)\.getTime\(\)[^\n]{0,30}(?:token|key|id|seed)|(?:token|key|id|seed)[^\n]{0,30}new Date\(\)\.getTime\(\)/gi, msg: '毫秒时间戳作为 token/seed 来源', sev: 'warn' },
|
|
303
304
|
{ re: /uuid[^\n]{0,20}Math\.random|Math\.random[^\n]{0,20}uuid/gi, msg: 'uuid 库 Math.random 形态（pre-v4 实现）', sev: 'warn' },
|
|
304
305
|
];
|
package/index.js
CHANGED
|
@@ -15,7 +15,7 @@ const { recordCall, getUpgradeMessage } = require('./core/license');
|
|
|
15
15
|
const skillpay = require('./core/skillpay');
|
|
16
16
|
const { formatHTMLReport, normalizeConfigFindings, normalizeBundleFindings, failHint } = require('./core/report');
|
|
17
17
|
|
|
18
|
-
const VERSION = '3.
|
|
18
|
+
const VERSION = '3.4.0';
|
|
19
19
|
const PRODUCT = 'correctover-scan';
|
|
20
20
|
const JS_EXT = new Set(['.js', '.mjs', '.cjs', '.ts']);
|
|
21
21
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "correctover-scan",
|
|
3
|
-
"version": "3.
|
|
3
|
+
"version": "3.4.0",
|
|
4
4
|
"description": "Correctover Security Scanner — CCS audit for MCP configurations AND published JS bundles/npm packages. Detects hardcoded secrets, RCE, SSRF, credential hijacking against OWASP AISVS 1.0.",
|
|
5
5
|
"main": "index.js",
|
|
6
6
|
"bin": {
|