[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_154":155,"_156":157},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_117":-5,"_20":118,"_22":119,"_120":121,"_122":123,"_25":124,"_24":-5,"_125":-5,"_126":-5,"_127":53,"_128":129,"_130":53,"_131":-5,"_132":-5,"_133":134},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","ernharth","name","cti-daily-digest","branchName","main","version","path","","project",{"_33":61,"_13":14,"_45":62,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":69,"_70":-5,"_71":72,"_73":-5,"_74":53,"_75":-5,"_76":-5,"_77":78,"_79":80,"_81":-5,"_82":-5,"_83":-5,"_84":-5,"_85":86,"_87":86,"_88":89,"_90":89,"_91":89,"_92":86,"_93":86,"_94":95,"_96":97,"_98":99,"_100":53},"tree",[56],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":55},"id","7b53a810-2dc3-481a-bcbb-7a0dbb23299d","main.ts","fileId","fc20320a-7e03-11f1-aaf4-1607ee4eb77e","parentId","branchId","5947c4bf-40c7-4704-8496-babad86e33c1","branchVersion",20,"latest",true,"createdAt",["D",1783875880300],19,"fileType","interval","content","// Daily Cyber Threat Intelligence digest for the insurance / financial-services sector.\n// Pulls the CISA KEV catalog + a ransomware victim feed, filters for insurer-relevant\n// items, and emails the val owner a briefing. Runs on a cron schedule (interval val).\nimport { email } from \"https://esm.town/v/std/email\";\nimport { XMLParser } from \"https://esm.sh/fast-xml-parser@4\";\n\nconst KEV_URL =\n \"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json\";\n\n// ransomware.live changes endpoints occasionally; try newest first.\nconst RANSOM_URLS = [\n \"https://api.ransomware.live/v2/recentvictims\",\n \"https://api.ransomware.live/recentvictims\",\n];\n\nconst LOOKBACK_DAYS = 2; // Cap on how far back we look, even after a pause.\n\n// Enterprise software commonly used by large insurers — used to flag KEV entries.\nconst VENDOR_KEYWORDS = [\n \"fortinet\", \"forti\", \"citrix\", \"netscaler\", \"microsoft\", \"sharepoint\", \"exchange\",\n \"windows\", \"cisco\", \"vpn\", \"ivanti\", \"pulse\", \"palo alto\", \"paloalto\", \"globalprotect\",\n \"f5\", \"big-ip\", \"oracle\", \"moveit\", \"gofileroom\", \"goanywhere\", \"cleo\", \"sonicwall\",\n \"okta\", \"identity\", \"active directory\", \"adfs\", \"email gateway\", \"proofpoint\",\n \"mimecast\", \"vmware\", \"esxi\", \"veeam\", \"adobe coldfusion\", \"coldfusion\",\n];\n\n// Insurance / finance sector terms — used to flag ransomware victims.\nconst SECTOR_KEYWORDS = [\n \"insur\", \"assurance\", \"reinsur\", \"underwrit\", \"actuar\", \"annuity\", \"annuities\",\n \"financ\", \"bank\", \"credit union\", \"brokerage\", \"broker\", \"mutual\", \"wealth\",\n \"capital\", \"holdings\", \"indemnity\", \"casualty\", \"life insurance\",\n];\n\n// High-signal English RSS/Atom feeds (from the OSINT source catalog).\nconst NEWS_FEEDS: { name: string; url: string }[] = [\n { name: \"The Hacker News\", url: \"https://feeds.feedburner.com/TheHackersNews\" },\n { name: \"BleepingComputer\", url: \"https://www.bleepingcomputer.com/feed/\" },\n { name: \"SecurityWeek\", url: \"https://www.securityweek.com/feed/\" },\n { name: \"The Record\", url: \"https://therecord.media/feed\" },\n { name: \"Dark Reading\", url: \"https://www.darkreading.com/rss.xml\" },\n { name: \"Help Net Security\", url: \"https://www.helpnetsecurity.com/feed/\" },\n { name: \"Cybersecurity Dive\", url: \"https://www.cybersecuritydive.com/feeds/news/\" },\n { name: \"Infosecurity Magazine\", url: \"https://www.infosecurity-magazine.com/rss/news/\" },\n { name: \"Security Affairs\", url: \"https://securityaffairs.com/feed\" },\n { name: \"GBHackers\", url: \"https://gbhackers.com/feed/\" },\n { name: \"Cybersecurity News\", url: \"https://cybersecuritynews.com/feed/\" },\n { name: \"Krebs on Security\", url: \"https://krebsonsecurity.com/feed/\" },\n { name: \"SANS ISC\", url: \"https://isc.sans.edu/rssfeed.xml\" },\n { name: \"The Register (Security)\", url: \"https://www.theregister.com/security/headlines.atom\" },\n];\n\n// Keywords used to keep only insurer-relevant / high-severity news items.\nconst NEWS_KEYWORDS = [\n ...VENDOR_KEYWORDS,\n ...SECTOR_KEYWORDS,\n \"ransomware\", \"zero-day\", \"zero day\", \"0-day\", \"actively exploited\",\n \"exploited in the wild\", \"in the wild\", \"data breach\", \"breach\", \"extortion\",\n \"cyberattack\", \"cyber attack\", \"credential\", \"phishing\", \"supply chain\",\n];\n\nfunction daysAgo(n: number): Date {\n return new Date(Date.now() - n * 86_400_000);\n}\n\nfunction parseDate(s: unknown): Date {\n if (!s) return new Date(0);\n // Feeds use \"2026-07-10 08:00:00.000000\"; normalise to ISO-ish.\n const iso = String(s).trim().replace(\" \", \"T\");\n const d = new Date(iso);\n return isNaN(d.getTime()) ? new Date(0) : d;\n}\n\nfunction esc(s: unknown): string {\n return String(s ?? \"\")\n .replace(/&/g, \"&\").replace(//g, \">\");\n}\n\nasync function fetchKev(cutoff: Date) {\n const res = await fetch(KEV_URL);\n if (!res.ok) throw new Error(`KEV HTTP ${res.status}`);\n const data = await res.json();\n const items: any[] = [];\n for (const v of data.vulnerabilities ?? []) {\n const added = parseDate(v.dateAdded);\n if (added < cutoff) continue;\n const hay =\n `${v.vendorProject} ${v.product} ${v.vulnerabilityName} ${v.shortDescription}`.toLowerCase();\n const relevant = VENDOR_KEYWORDS.some((k) => hay.includes(k));\n items.push({\n cve: v.cveID,\n vendor: v.vendorProject,\n product: v.product,\n name: v.vulnerabilityName,\n added: v.dateAdded,\n due: v.dueDate,\n ransomware: v.knownRansomwareCampaignUse,\n relevant,\n });\n }\n // Insurer-relevant first, then most recent.\n items.sort(\n (a, b) =>\n Number(b.relevant) - Number(a.relevant) ||\n parseDate(b.added).getTime() - parseDate(a.added).getTime(),\n );\n return items;\n}\n\nasync function fetchVictims(cutoff: Date) {\n let arr: any[] = [];\n let lastErr: unknown;\n for (const url of RANSOM_URLS) {\n try {\n const res = await fetch(url, { headers: { accept: \"application/json\" } });\n if (!res.ok) throw new Error(`HTTP ${res.status}`);\n const data = await res.json();\n arr = Array.isArray(data) ? data : (data.data ?? data.victims ?? []);\n if (arr.length) break;\n } catch (e) {\n lastErr = e;\n }\n }\n if (!arr.length && lastErr) console.error(\"ransomware feed failed:\", lastErr);\n\n const hits: any[] = [];\n for (const v of arr) {\n const when = parseDate(v.discovered ?? v.published ?? v.attackdate);\n if (when < cutoff) continue;\n const hay =\n `${v.post_title ?? v.victim ?? \"\"} ${v.activity ?? \"\"} ${v.description ?? \"\"}`\n .toLowerCase();\n if (!SECTOR_KEYWORDS.some((k) => hay.includes(k))) continue;\n hits.push({\n victim: v.post_title ?? v.victim ?? \"(unknown)\",\n group: v.group_name ?? v.group ?? \"?\",\n activity: v.activity ?? \"\",\n country: v.country ?? \"\",\n discovered: v.discovered ?? v.published ?? v.attackdate ?? \"\",\n });\n }\n return hits;\n}\n\nfunction pickLink(it: any): string {\n if (typeof it.link === \"string\") return it.link;\n if (Array.isArray(it.link)) {\n const alt = it.link.find((l: any) => l?.[\"@_rel\"] !== \"self\");\n return alt?.[\"@_href\"] ?? it.link[0]?.[\"@_href\"] ?? \"\";\n }\n if (it.link?.[\"@_href\"]) return it.link[\"@_href\"];\n if (it.guid) return String(it.guid?.[\"#text\"] ?? it.guid);\n if (it.id) return String(it.id);\n return \"\";\n}\n\nasync function fetchNews(cutoff: Date) {\n const parser = new XMLParser({ ignoreAttributes: false, attributeNamePrefix: \"@_\" });\n const results: any[] = [];\n const seen = new Set();\n\n await Promise.allSettled(\n NEWS_FEEDS.map(async (feed) => {\n try {\n const res = await fetch(feed.url, {\n headers: {\n \"user-agent\": \"Mozilla/5.0 (CTI-digest bot)\",\n accept: \"application/rss+xml, application/atom+xml, application/xml, text/xml, */*\",\n },\n signal: AbortSignal.timeout(9000),\n });\n if (!res.ok) throw new Error(`HTTP ${res.status}`);\n const xml = await res.text();\n const doc = parser.parse(xml);\n const channel = doc?.rss?.channel;\n let items: any[] = [];\n if (channel) {\n items = Array.isArray(channel.item) ? channel.item : channel.item ? [channel.item] : [];\n } else if (doc?.feed) {\n items = Array.isArray(doc.feed.entry) ? doc.feed.entry : doc.feed.entry ? [doc.feed.entry] : [];\n }\n\n let kept = 0;\n for (const it of items) {\n if (kept >= 6) break;\n const title = String(it.title?.[\"#text\"] ?? it.title ?? \"\").trim();\n if (!title) continue;\n const dateStr = it.pubDate ?? it.published ?? it.updated ?? it[\"dc:date\"] ?? \"\";\n const when = dateStr ? new Date(String(dateStr)) : new Date();\n if (!isNaN(when.getTime()) && when < cutoff) continue;\n const desc = String(\n it.description?.[\"#text\"] ?? it.description ?? it.summary?.[\"#text\"] ?? it.summary ?? \"\",\n );\n const hay = `${title} ${desc}`.toLowerCase();\n if (!NEWS_KEYWORDS.some((k) => hay.includes(k))) continue;\n const key = title.toLowerCase().replace(/[^a-z0-9]+/g, \" \").trim().slice(0, 80);\n if (!key || seen.has(key)) continue;\n seen.add(key);\n results.push({ title, link: pickLink(it), source: feed.name, date: String(dateStr) });\n kept++;\n }\n } catch (e) {\n console.error(`feed ${feed.name} failed:`, String(e));\n }\n }),\n );\n\n results.sort(\n (a, b) => new Date(b.date || 0).getTime() - new Date(a.date || 0).getTime(),\n );\n return results.slice(0, 30);\n}\n\nfunction buildHtml(kev: any[], victims: any[], news: any[], since: Date) {\n const relevantKev = kev.filter((k) => k.relevant);\n const otherKev = kev.filter((k) => !k.relevant);\n const today = new Date().toISOString().slice(0, 10);\n\n const kevRow = (k: any) => `\n \n \n ${esc(k.cve)}\n ${esc(k.vendor)} ${esc(k.product)}
\n ${esc(k.name)}\n ${k.ransomware && k.ransomware !== \"Unknown\" ? ` [ransomware use]` : \"\"}\n added ${esc(k.added)}
due ${esc(k.due ?? \"-\")}\n `;\n\n const victimRow = (v: any) => `\n \n ${esc(v.victim)}\n ${v.activity ? `
${esc(v.activity)}` : \"\"}\n ${esc(v.group)}\n ${esc(v.country)}
${esc(v.discovered)}\n `;\n\n const section = (title: string, rows: string, empty: string) => `\n

${title}

\n ${rows\n ? `${rows}

`\n : `

${empty}

`}`;\n\n const newsRow = (n: any) => `\n \n \n ${esc(n.title)}
\n ${esc(n.source)}${n.date ? \" · \" + esc(String(n.date).slice(0, 16)) : \"\"}\n `;\n\n return `\n

🛡️ Insurance-Sector CTI Digest — ${today}

\n New items since ${since.toISOString().slice(0, 10)} · Sources: CISA KEV, ransomware.live.\n Automated feed digest — verify before acting.

\n\n ${section(\n `⚠️ Actively-exploited CVEs in insurer-relevant software (${relevantKev.length})`,\n relevantKev.map(kevRow).join(\"\"),\n \"No new insurer-relevant KEV entries in the window.\",\n )}\n\n ${section(\n `🏢 Ransomware victims in insurance / finance (${victims.length})`,\n victims.map(victimRow).join(\"\"),\n \"No new insurance/finance-sector ransomware victims reported in the window.\",\n )}\n\n ${section(\n `📰 Threat news & advisories (${news.length})`,\n news.map(newsRow).join(\"\"),\n \"No matching news items in the window.\",\n )}\n\n ${section(\n `📋 Other new KEV additions (${otherKev.length})`,\n otherKev.slice(0, 15).map(kevRow).join(\"\"),\n \"None.\",\n )}\n

\n Generated by your Val Town cti-daily-digest job.

`;\n}\n\nexport default async function (interval: Interval) {\n const since = interval?.lastRunAt\n ? new Date(interval.lastRunAt)\n : daysAgo(LOOKBACK_DAYS);\n // Never look back more than LOOKBACK_DAYS even if the job was paused a long time.\n const cutoff = new Date(\n Math.max(since.getTime(), daysAgo(LOOKBACK_DAYS).getTime()),\n );\n\n let kev: any[] = [];\n let victims: any[] = [];\n try {\n kev = await fetchKev(cutoff);\n } catch (e) {\n console.error(\"KEV fetch failed:\", e);\n }\n try {\n victims = await fetchVictims(cutoff);\n } catch (e) {\n console.error(\"victim fetch failed:\", e);\n }\n let news: any[] = [];\n try {\n news = await fetchNews(cutoff);\n } catch (e) {\n console.error(\"news fetch failed:\", e);\n }\n\n const relevantCount = kev.filter((k) => k.relevant).length;\n console.log(\n `KEV total=${kev.length} insurer-relevant=${relevantCount} victims=${victims.length} news=${news.length}`,\n );\n\n const html = buildHtml(kev, victims, news, cutoff);\n const subject =\n `CTI Digest ${new Date().toISOString().slice(0, 10)} — ` +\n `${relevantCount} CVE(s), ${victims.length} victim(s), ${news.length} news`;\n\n await email({\n subject,\n html,\n text:\n `Insurance-sector CTI digest.\\n` +\n `Insurer-relevant KEV: ${relevantCount}\\n` +\n `New KEV total: ${kev.length}\\n` +\n `Insurance/finance ransomware victims: ${victims.length}\\n` +\n `Threat news/advisory items: ${news.length}\\n` +\n `(HTML version has details.)`,\n });\n\n return { kev: kev.length, relevant: relevantCount, victims: victims.length };\n}\n","deleted",false,"label",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":59,"_18":60},["D",1783875880300],"children",[],[35],"d6330c13-e641-4ee2-813e-1f012a67cf8f",["D",1783869100455],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Daily insurance CTI email digest","imageUrl","userId","9589d6cd-4e7f-4fc9-b59f-87d1fd0a10c8","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f56af-031e-75d4-8c5c-c45846cd4c86","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_116":112},"org",{"_11":12,"_109":110,"_111":112,"_71":72,"_113":114,"_115":53},"branch",{"_17":42,"_13":16,"_33":40,"_101":61,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":-5,"_107":14,"_108":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","-Stephen","avatar","https://lh3.googleusercontent.com/a/ACg8ocJ31wz1zxZLxXTM7FyodyM-_qHIea6xtFLrKrgIA5R4lmptmw=s96-c","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":61,"_13":14,"_45":150,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":69,"_70":-5,"_71":72,"_73":-5,"_74":53,"_75":-5,"_76":-5,"_77":78,"_79":80,"_81":-5,"_82":-5,"_83":-5,"_84":-5,"_85":86,"_87":86,"_88":89,"_90":89,"_91":89,"_92":86,"_93":86,"_94":151,"_96":152,"_98":153,"_100":53},[147],"files",[147],"counts",{"_137":78,"_138":139,"_140":78,"_31":141,"_142":143},[135],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":136},[35],"pulls","branches",1,"forks",{"_144":78,"_146":78},"connections",{"_144":78,"_145":78},"count","unfilledCount","emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":148,"_18":149},[],[35],["D",1783869100455],{"_11":12,"_116":112},{"_11":12,"_109":110,"_111":112,"_71":72,"_113":114,"_115":53},{"_17":42,"_13":16,"_33":40,"_101":61,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":-5,"_107":14,"_108":12},"ctx",{"_94":-5,"_132":187,"_188":189,"_190":191,"_192":53,"_193":53,"_194":53,"_195":44,"_196":-5,"_197":-7,"_198":-7,"_199":78,"_200":53,"_201":53,"_202":-5,"_203":53,"_204":53,"_205":53,"_206":-5},"ENV",{"_158":159,"_160":161,"_162":16,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","fdb67791413f4386b4dbf18f354029a617f6160f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Code