guardvibe 3.28.0 → 3.30.0

package/CHANGELOG.md

@@ -5,6 +5,27 @@ All notable changes to GuardVibe are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.30.0] - 2026-07-14
+
+### Added — 3 rules from daily intel: jscrambler + Injective supply-chain IOCs, n8n-mcp cross-tenant (453 → 456 rules)
+- **VG1100 — jscrambler Compromised Releases (July 2026 supply chain attack, critical).** Versions 8.14.0/8.16.0/8.17.0/8.18.0/8.20.0 published 2026-07-11 via a stolen npm credential run a Rust infostealer — 8.14–8.17 from an undocumented `preinstall` hook, 8.18+ as a self-executing function in `dist/index.js` (import-time). Targets cloud/CI credentials, browser sessions, crypto wallets, Bitwarden vaults, and AI coding-tool configs. Plugins (webpack/gulp/Metro/grunt) were NOT hit. Safe: 8.22.0+ or the pre-compromise 8.13.0. 10 tests.
+- **VG1101 — @injectivelabs/sdk-ts Wallet-Key Backdoor (July 2026, critical).** Version 1.20.21 (published 2026-07-08 from a compromised GitHub account) hooks `PrivateKey.fromMnemonic()`/`fromHex()` and exfiltrates BIP-39 seed phrases and private keys base64-encoded in the `X-Request-Id` header of fake-telemetry requests. Clean release: 1.20.23. 4 tests.
+- **VG1102 — n8n-mcp Multi-Tenant Cross-Tenant Access (CVE-2026-54052 / GHSA-j6r7-6fhx-77wx, critical).** Through 2.56.0, multi-tenant HTTP deployments fail to isolate workflow version backups — one tenant can read/delete another tenant's snapshots, leaking credential references and authorization headers from full node definitions. Fixed in 2.56.1. 0-FP semver: caret on 2.x / tilde within 2.56 resolve to the fix; only exact/= pins (and older lines) are flagged. 9 tests.
+
+### Changed
+- **VG1044 (@anthropic-ai/sdk Memory Tool)** description now records the assigned CVE ids — CVE-2026-41686 (insecure file permissions, fix 0.91.1) and CVE-2026-34451 (path escape, fix 0.81.0) — so CVE-number lookups resolve; version-space already fully covered, no pattern change.
+- **VG1043 (Hono pre-4.12.18 cluster)** description now also documents CVE-2026-56763 (parseBody `dot:true` `__proto__` prototype pollution, fix 4.12.7) and CVE-2026-56762 (setCookie missing cookie-name validation, fix 4.12.12) — both version windows were already fully flagged by this rule; no pattern change.
+
+CVE version-pin rule count 80 → 83.
+
+## [3.29.0] - 2026-06-27
+
+### Added — 2 rules from daily intel: deepstream prototype pollution + pnpm path-traversal cluster (451 → 453 rules)
+- **VG1098 — deepstream Server Prototype Pollution (CVE-2026-49252 / GHSA-9v98-6g37-x9g6, critical, CVSS 9.9).** `@deepstream/server` before 10.0.5 lets an authenticated client with write permissions merge `__proto__`-style keys onto `Object.prototype` via a crafted record/RPC payload — privilege escalation / DoS across the realtime server. Published 2026-06-26. 0-FP semver: 10.0.5 is a patch within 10.0, so caret/tilde on 10.0.x resolve to the fix; only exact/= pins in 10.0.0–10.0.4 (and any range on 0.x–9.x) are flagged. 9 tests.
+- **VG1099 — pnpm Lockfile/Manifest Path-Traversal & RCE Cluster (CVE-2026-55698 / -55487 / -50016 and others, June 2026, high).** A crafted `pnpm-lock.yaml` / manifest can escape the project root and overwrite arbitrary files on the install host (transitive alias path traversal, manifest identity spoof running attacker lifecycle scripts, env-lockfile resolution short-circuit, malicious patch-file write) — supply-chain RCE on dev/CI machines. Fixed in 10.34.2 (10.x) / 11.5.3 (11.x). Flags the Corepack `packageManager` pin (always exact): any `pnpm@` below 10.34.2, or in 11.0.0–11.5.2; recommends 10.34.4 / 11.8.0. 12 tests.
+
+CVE version-pin rule count 78 → 80. Gate green (build / lint / test / self-audit PASS / A / 0).
+
 ## [3.28.0] - 2026-06-25
 
 ### Added — 1 rule from daily intel: i18next missing-key prototype pollution (450 → 451 rules)

package/README.md

@@ -9,13 +9,13 @@
 > **Security infrastructure your AI can't be.**
 > No matter how good your coding agent gets, it can't know the CVE published after its training cutoff, it can't deterministically guarantee the same check every run, it can't hold your whole repo in context, and it can't objectively review its own code. GuardVibe does all four — the deterministic, post-cutoff-current, whole-repo, author-independent verification layer for AI-written code.
 
-- **🗓️ Knows what your AI doesn't.** CVE rules refreshed **daily** from GHSA / OSV.dev / CISA KEV — GuardVibe flags vulnerable dependencies published *after* your model's training cutoff. (78 CVE rules, `npm run intel` daily triage.)
+- **🗓️ Knows what your AI doesn't.** CVE rules refreshed **daily** from GHSA / OSV.dev / CISA KEV — GuardVibe flags vulnerable dependencies published *after* your model's training cutoff. (83 CVE rules, `npm run intel` daily triage.)
 - **🎯 Deterministic, not probabilistic.** Same code = same result, every run (content-hashed). Your AI guesses; GuardVibe doesn't.
 - **🗺️ Sees the whole repo.** Cross-file taint + auth-coverage across every route — catches the unprotected endpoint your agent's narrow context missed.
 - **🔍 An independent second pair of eyes.** The thing that wrote the code can't review itself. GuardVibe is the outside checker on AI-written code — in the loop *while* your AI codes (real-time edit hook), not after.
 - **⬅️ NEW: Starts before the first line of code.** Every scanner on earth — including your agent reviewing itself — acts *after* the code exists. [`secure_prompt`](#prompt-level-security-shift-left) acts *before*: it analyzes the coding prompt itself, detects the stack and attack surfaces it implies, and embeds severity-ranked GuardVibe requirements into the prompt your AI executes. The vulnerability is prevented, not caught. Deterministic, zero LLM calls — and if the prompt is already secure, it passes through untouched.
 
-**The security MCP built for vibe coding.** 451 security rules, 39 tools covering the entire AI-generated code journey — from the prompt itself to production deployment.
+**The security MCP built for vibe coding.** 456 security rules, 39 tools covering the entire AI-generated code journey — from the prompt itself to production deployment.
 
 Works with **Claude Code, Cursor, Gemini CLI, Codex, VS Code (Copilot), Windsurf**, and any MCP-compatible coding agent.
 
@@ -27,11 +27,11 @@ Works with **Claude Code, Cursor, Gemini CLI, Codex, VS Code (Copilot), Windsurf
 
 Most security tools are built for enterprise security teams. GuardVibe is built for **you** — the developer using AI to build and ship web apps fast.
 
-- **451 security rules, 39 tools** purpose-built for the stacks AI agents generate
+- **456 security rules, 39 tools** purpose-built for the stacks AI agents generate
 - **Zero setup friction** — `npx guardvibe` and you're scanning
 - **No account required** — runs 100% locally, no API keys, no cloud
 - **Understands your stack** — not generic SAST, but rules that know Next.js, Supabase, Stripe, Clerk, and the tools you actually use
-- **CVE version intelligence** — detects 78 known vulnerable package versions in package.json, refreshed every day from GHSA / OSV.dev / CISA KEV
+- **CVE version intelligence** — detects 83 known vulnerable package versions in package.json, refreshed every day from GHSA / OSV.dev / CISA KEV
 - **AI agent & MCP security** — detects MCP server vulnerabilities, tool-description prompt injection (OWASP MCP Top 10), model-controlled sandbox-disable flags, excessive AI permissions, indirect prompt injection
 - **Auto-fix suggestions** — `fix_code` tool returns concrete patches and structured edits the AI agent can apply mechanically. Coverage: hardcoded credentials → env-var migration; public-prefix LLM keys (`NEXT_PUBLIC_/VITE_/EXPO_PUBLIC_/REACT_APP_`) → prefix removal; CORS wildcards → env allowlist; `dangerouslyAllowBrowser` flags → drop; sandbox bypass flags (`unsafe`/`noSandbox`/`allowEval`) → drop; agent loops → add `maxSteps`; raw-HTML React props → `<ReactMarkdown>`; missing auth checks → insert auth guard; SQL injection → parameterized queries; missing rate limiters / CSRF / security headers → snippet templates.
 - **Pre-commit hook** — block insecure code before it reaches your repo
@@ -62,10 +62,10 @@ GuardVibe is purpose-built for the AI coding workflow. Traditional tools are exc
 | AI/LLM security (prompt injection, MCP, tool abuse) | 68 rules | Experimental/None | None |
 | AI host security (CVE-2025-59536, CVE-2026-21852) | `guardvibe doctor` | Not supported | Not supported |
 | Auto-fix suggestions for AI agents | `fix_code` tool | CLI autofix | Not supported |
-| CVE version detection | 78 packages, refreshed daily | Extensive | Extensive |
+| CVE version detection | 83 packages, refreshed daily | Extensive | Extensive |
 | Compliance mapping (SOC2, PCI-DSS, HIPAA) | Built-in | Paid tier | None |
 | SARIF CI/CD export | Yes | Yes | Limited |
-| Rule count | 451 (focused, 68 AI-native) | 5000+ (broad) | N/A |
+| Rule count | 456 (focused, 68 AI-native) | 5000+ (broad) | N/A |
 
 **When to use GuardVibe:** You're building with AI agents and want security scanning integrated into your coding workflow — no dashboard, no account, no CI setup.
 
@@ -190,7 +190,7 @@ React Native, Expo — AsyncStorage secrets, deep link token exposure, hardcoded
 ### Firebase
 Firestore security rules, Firebase Admin SDK exposure, storage rules, custom token validation
 
-### CVE Version Intelligence (78 CVEs, refreshed daily)
+### CVE Version Intelligence (83 CVEs, refreshed daily)
 **Frameworks:** Next.js (CVE-2024-34351, CVE-2024-46982, CVE-2025-29927, CVE-2026-23869, CVE-2026-44573 / 44574 / 44575 / 44578 / 44579 / 45109 May 2026 cluster), React + react-server-dom-* (CVE-2025-55182, CVE-2026-23870), Express, Hono pre-4.12.18 cluster, @vitejs/plugin-rsc, Strapi content-type-builder (CVE-2026-22599)
 **Auth:** Clerk middleware bypass (GHSA-vqx2), Clerk `has()` org/billing/reverification bypass (GHSA-w24r), Clerk `clerkFrontendApiProxy` SSRF (CVE-2026-34076), NextAuth.js (2 CVEs), jsonwebtoken
 **ORMs / SQL:** Drizzle SQL identifier injection (CVE-2026-39356) + Drizzle `sql.raw` interpolation (VG1073), MikroORM SQL injection (CVE-2026-44680), Prisma raw-query call-form, Kysely JSON-path traversal (CVE-2026-44635)
@@ -302,7 +302,7 @@ The offline tier is also a `full_audit` section (online never runs inside the au
 { "slopscan": { "online": true, "allow": ["@myorg/internal-pkg"] } }
 ```
 
-## Security Rules (451 rules across 25 modules)
+## Security Rules (456 rules across 25 modules)
 
 | Category | Rules | Coverage |
 |----------|-------|----------|
@@ -321,7 +321,7 @@ The offline tier is also a `full_audit` section (online never runs inside the au
 | AI / LLM Security | 33 | Prompt injection, MCP SSRF, excessive agency, indirect injection |
 | **AI Host Security** | **14** | **CVE-2025-59536 hook injection, CVE-2026-21852 base URL hijack, MCP config audit** |
 | **AI Tool Runtime** | **14** | **MCP tool output sanitization, obfuscated descriptions, safety bypass** |
-| CVE Version Intelligence | 76 | Known vulnerable versions in package.json — incl. Vite dev-server cmd injection (CVE-2024-52011), React Router 7 cluster (CVE-2026-33245/42211/42342), DOMPurify XSS (CVE-2026-47423), Better Auth bypass (CVE-2026-45337), Axios supply-chain backdoor |
+| CVE Version Intelligence | 81 | Known vulnerable versions in package.json — incl. Vite dev-server cmd injection (CVE-2024-52011), React Router 7 cluster (CVE-2026-33245/42211/42342), DOMPurify XSS (CVE-2026-47423), Better Auth bypass (CVE-2026-45337), Axios supply-chain backdoor |
 | Shell / Bash | 5 | Pipe to bash, chmod 777, rm -rf, sudo password |
 | SQL | 4 | DROP/DELETE without WHERE, stacked queries, GRANT ALL |
 | Supply Chain | 19 | Malicious install scripts, lockfile integrity, dependency confusion, typosquat detection |

package/build/data/rules/cve-versions.js

@@ -450,7 +450,7 @@ export const cveVersionRules = [
         name: "Hono Pre-4.12.18 Multiple Vulnerabilities (JWT, Cache Vary, JSX, bodyLimit, serveStatic, ALB IP spoof)",
         severity: "high",
         owasp: "A05:2025 Security Misconfiguration",
-        description: "Hono versions before 4.12.18 are affected by a cluster of issues. May 2026 wave (fix 4.12.18 unless noted): JWT verify() does not validate NumericDate claims exp/nbf/iat (GHSA-hm8q-7f3q-5f36), Cache Middleware ignores Vary: Authorization and Vary: Cookie leading to cross-user cache leakage (GHSA-p77w-8qqv-26rm), hono/jsx renders unvalidated JSX tag names enabling HTML injection (GHSA-69xw-7hcm-h432, fix 4.12.16), bodyLimit() can be bypassed for chunked or unknown-length requests (GHSA-9vqf-7f2p-gf9v, fix 4.12.16). Hono < 4.12.4 is additionally exposed to two HIGH-severity earlier issues: arbitrary file access via serveStatic (CVE-2026-29045, GHSA-q5qw-h33p-qvwr) and authentication bypass by IP spoofing in AWS Lambda ALB conninfo (CVE-2026-27700, GHSA-xh87-mx6m-69f3). Upgrade to 4.12.18+ to cover the whole cluster.",
+        description: "Hono versions before 4.12.18 are affected by a cluster of issues. May 2026 wave (fix 4.12.18 unless noted): JWT verify() does not validate NumericDate claims exp/nbf/iat (GHSA-hm8q-7f3q-5f36), Cache Middleware ignores Vary: Authorization and Vary: Cookie leading to cross-user cache leakage (GHSA-p77w-8qqv-26rm), hono/jsx renders unvalidated JSX tag names enabling HTML injection (GHSA-69xw-7hcm-h432, fix 4.12.16), bodyLimit() can be bypassed for chunked or unknown-length requests (GHSA-9vqf-7f2p-gf9v, fix 4.12.16). Hono < 4.12.4 is additionally exposed to two HIGH-severity earlier issues: arbitrary file access via serveStatic (CVE-2026-29045, GHSA-q5qw-h33p-qvwr) and authentication bypass by IP spoofing in AWS Lambda ALB conninfo (CVE-2026-27700, GHSA-xh87-mx6m-69f3). July 2026 disclosures also land inside this window: parseBody with the dot:true option accepts __proto__ form-field keys enabling prototype pollution (CVE-2026-56763, fix 4.12.7), and setCookie()/serialize()/serializeSigned() accept unvalidated cookie names including \\r\\n control characters (CVE-2026-56762, fix 4.12.12) — both fully covered by the 4.12.18 upgrade this rule enforces.",
         pattern: /["']hono["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-3]\.\d+\.\d+|4\.(?:[0-9]|1[01])\.\d+|4\.12\.(?:[0-9]|1[0-7]))["']/g,
         languages: ["json"],
         fix: "Upgrade Hono to 4.12.18 or later: npm install hono@latest. If using cache middleware, explicitly set Vary headers; if using JWT verify, treat exp/nbf/iat as untrusted until upgrade lands.",
@@ -462,7 +462,7 @@ export const cveVersionRules = [
         name: "Anthropic TS SDK Memory Tool Insecure File Permissions and Path Escape (GHSA-p7fg / GHSA-5474)",
         severity: "high",
         owasp: "A01:2025 Broken Access Control",
-        description: "@anthropic-ai/sdk versions 0.79.0 through 0.91.0 expose the local-filesystem Memory Tool with two issues: default file permissions are world-readable, leaking memory contents to other users on shared hosts (GHSA-p7fg-763f-g4gf, fix 0.91.1), and path validation in the Memory Tool can be bypassed to read or write sibling directories outside the configured root (GHSA-5474-4w2j-mq4c, fix 0.81.0). Upgrade to 0.91.1+ to cover both, and avoid placing the Memory Tool root on multi-tenant filesystems.",
+        description: "@anthropic-ai/sdk versions 0.79.0 through 0.91.0 expose the local-filesystem Memory Tool with two issues: default file permissions are world-readable, leaking memory contents to other users on shared hosts (GHSA-p7fg-763f-g4gf, fix 0.91.1), and path validation in the Memory Tool can be bypassed to read or write sibling directories outside the configured root (GHSA-5474-4w2j-mq4c, fix 0.81.0). The permissions issue was later assigned CVE-2026-41686 and the path escape CVE-2026-34451. Upgrade to 0.91.1+ to cover both, and avoid placing the Memory Tool root on multi-tenant filesystems.",
         pattern: /["']@anthropic-ai\/sdk["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:0\.(?:79|8[0-9]|90)\.\d+|0\.91\.0)["']/g,
         languages: ["json"],
         fix: "Upgrade @anthropic-ai/sdk to 0.91.1 or later. Restrict Memory Tool root to a single-tenant directory with mode 0700. Audit any agent that exposes the Memory Tool to untrusted prompts.",
@@ -913,4 +913,64 @@ export const cveVersionRules = [
         fixCode: '// package.json\n"i18next-fs-backend": "^2.6.6",  // or latest\n"i18next-http-middleware": "^3.9.7"  // or latest',
         compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.5.1", "HIPAA:§164.312(a)"],
     },
+    {
+        id: "VG1098",
+        name: "deepstream Server Prototype Pollution (CVE-2026-49252 / GHSA-9v98-6g37-x9g6)",
+        severity: "critical",
+        owasp: "A03:2025 Injection",
+        description: "@deepstream/server versions before 10.0.5 are vulnerable to prototype pollution (CVSS 9.9). An authenticated client with write permissions can craft a record/RPC payload whose keys (e.g. __proto__) are merged onto Object.prototype, corrupting global object state across the realtime server — privilege escalation and denial of service. Fixed in 10.0.5. 0-FP semver: 10.0.5 is a patch within the 10.0 line, so a caret (^10.0.x) or tilde (~10.0.x) range resolves to the fixed release and is not flagged — only exact/= pins in 10.0.0–10.0.4 are. Older 0.x–9.x majors are flagged with any range since they never reach the fix.",
+        pattern: /["']@deepstream\/server["']\s*:\s*["'](?:(?:\^|~|>=?)?\s*[0-9]\.\d+\.\d+|=?\s*10\.0\.[0-4](?![0-9]))["']/g,
+        languages: ["json"],
+        fix: "Upgrade @deepstream/server to 10.0.5 or later: npm install @deepstream/server@latest. As defence-in-depth, freeze Object.prototype at startup (Object.freeze(Object.prototype)) and reject record keys named __proto__, constructor, or prototype before merging client payloads.",
+        fixCode: '// package.json\n"@deepstream/server": "^10.0.5"  // or latest\n\n// Defence-in-depth — block prototype writes at bootstrap\nObject.freeze(Object.prototype);',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.5.1", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG1099",
+        name: "pnpm Lockfile/Manifest Path-Traversal & RCE Cluster (CVE-2026-55698 / -55487 / -50016, June 2026)",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "pnpm before 10.34.2 (10.x line) and before 11.5.3 (11.x line) is affected by a June-2026 cluster of path-traversal and arbitrary-file-write/RCE advisories driven by attacker-controlled lockfiles and manifests: transitive dependency alias path traversal escaping the project root (CVE-2026-50016), manifest identity spoofing that satisfies allowBuilds and runs attacker lifecycle scripts (CVE-2026-55487), project env-lockfile short-circuiting package-manager resolution (CVE-2026-55698), reserved-bin-name deletion of PNPM_HOME (CVE-2026-55699), and malicious patch-file arbitrary write/delete (CVE-2026-50015), among others. A crafted pnpm-lock.yaml can overwrite arbitrary files on the install host — supply-chain RCE on developer and CI machines. This rule flags the Corepack `packageManager` pin (always an exact version), so a caret/tilde never applies: any pnpm@ below 10.34.2, or in the 11.0.0–11.5.2 window, is flagged; 10.34.2+/11.5.3+ are clean (the brief recommends 10.34.4 / 11.8.0).",
+        pattern: /["']packageManager["']\s*:\s*["']pnpm@(?:[0-9]\.\d+\.\d+|10\.(?:[0-9]|[12]\d|3[0-3])\.\d+|10\.34\.[01](?![0-9])|11\.[0-4]\.\d+|11\.5\.[0-2](?![0-9]))(?:\+[^"']*)?["']/g,
+        languages: ["json"],
+        fix: "Upgrade pnpm to 10.34.4+ (10.x) or 11.8.0+ (11.x): update the packageManager field and run `corepack use pnpm@latest`. Until then, treat untrusted pnpm-lock.yaml / patch files as hostile and review dependency aliases for ../, absolute paths, or reserved names (.bin, .pnpm) before install.",
+        fixCode: '// package.json — Corepack pin to a patched pnpm\n"packageManager": "pnpm@11.8.0"  // or "pnpm@10.34.4" for the 10.x line',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2", "PCI-DSS:Req6.3.2"],
+    },
+    {
+        id: "VG1100",
+        name: "jscrambler Compromised Releases (Supply Chain Attack July 2026)",
+        severity: "critical",
+        owasp: "A03:2025 Software Supply Chain Failures",
+        description: "jscrambler versions 8.14.0, 8.16.0, 8.17.0, 8.18.0 and 8.20.0 were published on 11 July 2026 via a compromised npm publishing credential. 8.14.0/8.16.0/8.17.0 run a Rust infostealer from an undocumented preinstall hook (dist/setup.js); 8.18.0/8.20.0 drop the install hook and instead inject the identical dropper as a self-executing function at the top of dist/index.js and dist/bin/jscrambler.js, so it fires on import or CLI run rather than at install. The payload targets cloud credentials, CI tokens, browser sessions, crypto wallets, Bitwarden vaults, and AI coding tool configs (Claude Desktop, Cursor). Only the core jscrambler package was hit — the webpack/gulp/Metro/grunt plugins stayed clean. Any lockfile or exact pin resolving to these versions is actively compromised; ranges are flagged too because installs during the attack window may have resolved to them.",
+        pattern: /["']jscrambler["']\s*:\s*["'](?:\^|~|>=?)?\s*8\.(?:14|16|17|18|20)\.0["']/g,
+        languages: ["json"],
+        fix: "Upgrade jscrambler to 8.22.0+ (first confirmed-clean release; 8.13.0 is the safe pre-compromise fallback). Verify the lockfile does not resolve to a malicious version, then rotate ALL secrets reachable from the affected machine: cloud credentials, CI tokens, npm tokens, browser sessions, crypto wallet keys, and AI tool API keys.",
+        fixCode: '// COMPROMISED — remove immediately:\n// "jscrambler": "8.14.0"  ← preinstall infostealer\n// "jscrambler": "8.18.0"  ← import-time infostealer\n\n// Safe:\n"jscrambler": "^8.22.0"  // or pin the pre-compromise 8.13.0\n\n// Post-incident: rotate cloud/CI/npm tokens, wallets, AI tool keys',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2", "PCI-DSS:Req6.5.10"],
+    },
+    {
+        id: "VG1101",
+        name: "@injectivelabs/sdk-ts Wallet-Key Backdoor (Supply Chain Attack July 2026)",
+        severity: "critical",
+        owasp: "A03:2025 Software Supply Chain Failures",
+        description: "@injectivelabs/sdk-ts version 1.20.21, published 8 July 2026 from a compromised Injective Labs GitHub account, hooks the key-derivation entry points PrivateKey.fromMnemonic() and PrivateKey.fromHex() and exfiltrates raw BIP-39 seed phrases and private keys base64-encoded inside the X-Request-Id header of fake-telemetry HTTP requests. The version was live ~49 minutes and downloaded 310 times before deprecation; 17 sibling Injective packages linked to it transitively. Any project resolving to 1.20.21 must treat every key or mnemonic that passed through the package as compromised.",
+        pattern: /["']@injectivelabs\/sdk-ts["']\s*:\s*["'](?:\^|~|>=?)?\s*1\.20\.21["']/g,
+        languages: ["json"],
+        fix: "Upgrade @injectivelabs/sdk-ts to 1.20.23 or later (1.20.22 was skipped; 1.20.23 is the confirmed-clean release): npm install @injectivelabs/sdk-ts@latest. Rotate every private key and seed phrase loaded while the malicious version was installed, and audit transitive dependencies for pins to 1.20.21.",
+        fixCode: '// COMPROMISED — remove immediately:\n// "@injectivelabs/sdk-ts": "1.20.21"  ← wallet-key stealer\n\n// Safe:\n"@injectivelabs/sdk-ts": "^1.20.23"  // or latest\n\n// Post-incident: rotate ALL keys/mnemonics used with the SDK',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2", "PCI-DSS:Req6.5.10"],
+    },
+    {
+        id: "VG1102",
+        name: "n8n-mcp Multi-Tenant Cross-Tenant Access (CVE-2026-54052 / GHSA-j6r7-6fhx-77wx)",
+        severity: "critical",
+        owasp: "A01:2025 Broken Access Control",
+        description: "n8n-mcp versions through 2.56.0 fail to isolate workflow version backups between tenants in multi-tenant HTTP deployments (ENABLE_MULTI_TENANT=true): an authenticated user from one tenant can read, delete, or destroy workflow snapshots belonging to other tenants. Snapshots contain full node definitions, so credential references and authorization headers leak across the tenant boundary. Single-user/stdio and single-tenant HTTP deployments are unaffected, but the flagged version-space is identical either way — upgrade closes the gap. Fixed in 2.56.1 with per-instance isolation and a one-time migration. 0-FP semver: a caret range on 2.x and a tilde within 2.56 resolve to the fixed 2.56.1, so only exact/= pins (and tilde/exact within 2.0–2.55, plus any range on 0.x/1.x) are flagged.",
+        pattern: /["']n8n-mcp["']\s*:\s*["'](?:(?:\^|~|>=?)?\s*[01]\.\d+\.\d+|(?:~|=)?\s*2\.(?:[0-9]|[1-4]\d|5[0-5])\.\d+|=?\s*2\.56\.0(?![0-9]))["']/g,
+        languages: ["json"],
+        fix: "Upgrade n8n-mcp to 2.56.1 or later: npm install n8n-mcp@latest (the upgrade runs a one-time migration that isolates stored version history per instance). If running multi-tenant HTTP, audit workflow snapshot access logs for cross-tenant reads before the upgrade.",
+        fixCode: '// package.json\n"n8n-mcp": "^2.56.1"  // or latest',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.5.10", "HIPAA:§164.312(a)"],
+    },
 ];

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "guardvibe",
-  "version": "3.28.0",
+  "version": "3.30.0",
   "mcpName": "io.github.goklab/guardvibe",
-  "description": "Security infrastructure your AI can't be — deterministic, current past your model's training cutoff, whole-repo-aware, author-independent. Security MCP for vibe coding. 451 rules, 39 tools, CLI + doctor. Prompt-level shift-left security (secure_prompt — embed security requirements BEFORE code generation), host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. 78 CVE rules refreshed daily from GHSA/OSV/CISA KEV — js-cookie cookie-attribute injection, PostCSS </style> stringify XSS, Axios proxy prototype-pollution gadget, Vite dev-server RCE, React Router 7 cluster, DOMPurify XSS, Better Auth bypass, Miasma @redhat-cloud-services compromise, Next.js May 2026 13-advisory cluster, Drizzle/MikroORM/Kysely SQL injection, Axios proxy-auth redirect leak, Hono setCookie attribute injection, Clerk SSRF, tRPC prototype pollution, @tanstack supply-chain, node-ipc protestware, OpenClaude sandbox bypass, plus the full AI-generated stack (Supabase, Stripe, Prisma, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK). 68 AI-native rules including OWASP MCP Top 10 tool-description prompt injection (VG1068), model-controlled sandbox-disable flag detection (VG1063), Session messenger exfil endpoint IOC (VG1075), and CI/CD supply-chain hardening (VG1070 npm --expect-provenance / --ignore-scripts enforcement).",
+  "description": "Security infrastructure your AI can't be — deterministic, current past your model's training cutoff, whole-repo-aware, author-independent. Security MCP for vibe coding. 456 rules, 39 tools, CLI + doctor. Prompt-level shift-left security (secure_prompt — embed security requirements BEFORE code generation), host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. 83 CVE rules refreshed daily from GHSA/OSV/CISA KEV — jscrambler infostealer compromise, @injectivelabs/sdk-ts wallet-key backdoor, n8n-mcp cross-tenant isolation, js-cookie cookie-attribute injection, PostCSS </style> stringify XSS, Axios proxy prototype-pollution gadget, Vite dev-server RCE, React Router 7 cluster, DOMPurify XSS, Better Auth bypass, Miasma @redhat-cloud-services compromise, Next.js May 2026 13-advisory cluster, Drizzle/MikroORM/Kysely SQL injection, Axios proxy-auth redirect leak, Hono setCookie attribute injection, Clerk SSRF, tRPC prototype pollution, @tanstack supply-chain, node-ipc protestware, OpenClaude sandbox bypass, plus the full AI-generated stack (Supabase, Stripe, Prisma, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK). 68 AI-native rules including OWASP MCP Top 10 tool-description prompt injection (VG1068), model-controlled sandbox-disable flag detection (VG1063), Session messenger exfil endpoint IOC (VG1075), and CI/CD supply-chain hardening (VG1070 npm --expect-provenance / --ignore-scripts enforcement).",
   "type": "module",
   "bin": {
     "guardvibe": "build/cli.js",