correctover-scan 3.3.2 → 3.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/core/bundle-scanner.js +1 -0
- package/index.js +1 -1
- package/package.json +1 -1
package/core/bundle-scanner.js
CHANGED
|
@@ -299,6 +299,7 @@ const CHECKS = [
|
|
|
299
299
|
{ re: /0x3ade68b1|0x3ade67b7|0x9069\s*\*\s*\(m_z/g, msg: 'crypto-js 3.x WordArray.random 固定常量弱 PRNG（CVE-2026-71851 家族）', sev: 'fail' },
|
|
300
300
|
{ re: /rng_psize|Arcfour|new SecureRandom\s*\(/g, msg: 'jsbn SecureRandom 池指纹——Math.random 播种面（CVE-2026-73567 家族）', sev: 'warn' },
|
|
301
301
|
{ re: /\b(?:key|private|secret|token|salt|nonce|seed|iv|password)\b[^\n]{0,40}Math\.random|Math\.random[^\n]{0,40}\b(?:key|private|secret|token|salt|nonce|seed|iv)\b/gi, msg: 'Math.random 出现在密钥/盐/令牌语义邻域', sev: 'fail' },
|
|
302
|
+
{ re: /function\s+[a-zA-Z0-9_]*(?:[Kk]ey|[Ss]eed|[Tt]oken|[Nn]once)[a-zA-Z0-9_]*\s*\([^)]*\)\s*\{[^}]*Math\.random/g, msg: 'Math.random 在密钥/token 生成函数体内（函数名语义）', sev: 'fail' },
|
|
302
303
|
{ re: /new Date\(\)\.getTime\(\)[^\n]{0,30}(?:token|key|id|seed)|(?:token|key|id|seed)[^\n]{0,30}new Date\(\)\.getTime\(\)/gi, msg: '毫秒时间戳作为 token/seed 来源', sev: 'warn' },
|
|
303
304
|
{ re: /uuid[^\n]{0,20}Math\.random|Math\.random[^\n]{0,20}uuid/gi, msg: 'uuid 库 Math.random 形态（pre-v4 实现）', sev: 'warn' },
|
|
304
305
|
];
|
package/index.js
CHANGED
|
@@ -15,7 +15,7 @@ const { recordCall, getUpgradeMessage } = require('./core/license');
|
|
|
15
15
|
const skillpay = require('./core/skillpay');
|
|
16
16
|
const { formatHTMLReport, normalizeConfigFindings, normalizeBundleFindings, failHint } = require('./core/report');
|
|
17
17
|
|
|
18
|
-
const VERSION = '3.
|
|
18
|
+
const VERSION = '3.4.0';
|
|
19
19
|
const PRODUCT = 'correctover-scan';
|
|
20
20
|
const JS_EXT = new Set(['.js', '.mjs', '.cjs', '.ts']);
|
|
21
21
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "correctover-scan",
|
|
3
|
-
"version": "3.
|
|
3
|
+
"version": "3.4.0",
|
|
4
4
|
"description": "Correctover Security Scanner — CCS audit for MCP configurations AND published JS bundles/npm packages. Detects hardcoded secrets, RCE, SSRF, credential hijacking against OWASP AISVS 1.0.",
|
|
5
5
|
"main": "index.js",
|
|
6
6
|
"bin": {
|