[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_154":155,"_156":157},"routes/_app.x.$handle.$name",{"_95":94,"_32":45,"_104":85,"_27":105,"_13":14,"_106":-5,"_11":107,"_108":109,"_110":111,"_112":113,"_114":115,"_20":-5,"_116":-5,"_117":-5,"_118":25,"_119":120,"_121":25,"_122":-5,"_123":-5,"_124":125},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":78,"_79":80,"_81":82,"_83":25},"version",8,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","fc20320a-7e03-11f1-aaf4-1607ee4eb77e","name","fileType","interval","content","// Daily Cyber Threat Intelligence digest for the insurance / financial-services sector.\n// Pulls the CISA KEV catalog + a ransomware victim feed, filters for insurer-relevant\n// items, and emails the val owner a briefing. Runs on a cron schedule (interval val).\nimport { email } from \"https://esm.town/v/std/email\";\n\nconst KEV_URL =\n \"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json\";\n\n// ransomware.live changes endpoints occasionally; try newest first.\nconst RANSOM_URLS = [\n \"https://api.ransomware.live/v2/recentvictims\",\n \"https://api.ransomware.live/recentvictims\",\n];\n\nconst LOOKBACK_DAYS = 2; // Cap on how far back we look, even after a pause.\n\n// Enterprise software commonly used by large insurers — used to flag KEV entries.\nconst VENDOR_KEYWORDS = [\n \"fortinet\", \"forti\", \"citrix\", \"netscaler\", \"microsoft\", \"sharepoint\", \"exchange\",\n \"windows\", \"cisco\", \"vpn\", \"ivanti\", \"pulse\", \"palo alto\", \"paloalto\", \"globalprotect\",\n \"f5\", \"big-ip\", \"oracle\", \"moveit\", \"gofileroom\", \"goanywhere\", \"cleo\", \"sonicwall\",\n \"okta\", \"identity\", \"active directory\", \"adfs\", \"email gateway\", \"proofpoint\",\n \"mimecast\", \"vmware\", \"esxi\", \"veeam\", \"adobe coldfusion\", \"coldfusion\",\n];\n\n// Insurance / finance sector terms — used to flag ransomware victims.\nconst SECTOR_KEYWORDS = [\n \"insur\", \"assurance\", \"reinsur\", \"underwrit\", \"actuar\", \"annuity\", \"annuities\",\n \"financ\", \"bank\", \"credit union\", \"brokerage\", \"broker\", \"mutual\", \"wealth\",\n \"capital\", \"holdings\", \"indemnity\", \"casualty\", \"life insurance\",\n];\n\nfunction daysAgo(n: number): Date {\n return new Date(Date.now() - n * 86_400_000);\n}\n\nfunction parseDate(s: unknown): Date {\n if (!s) return new Date(0);\n // Feeds use \"2026-07-10 08:00:00.000000\"; normalise to ISO-ish.\n const iso = String(s).trim().replace(\" \", \"T\");\n const d = new Date(iso);\n return isNaN(d.getTime()) ? new Date(0) : d;\n}\n\nfunction esc(s: unknown): string {\n return String(s ?? \"\")\n .replace(/&/g, \"&\").replace(//g, \">\");\n}\n\nasync function fetchKev(cutoff: Date) {\n const res = await fetch(KEV_URL);\n console.log(`KEV fetch status=${res.status} ct=${res.headers.get(\"content-type\")}`);\n if (!res.ok) throw new Error(`KEV HTTP ${res.status}`);\n const data = await res.json();\n console.log(`KEV catalogVersion=${data.catalogVersion} count=${(data.vulnerabilities ?? []).length}`);\n const sample = (data.vulnerabilities ?? [])[0];\n console.log(`sample dateAdded=${sample?.dateAdded} parsed=${parseDate(sample?.dateAdded).toISOString()} cutoff=${cutoff.toISOString()} now=${new Date().toISOString()}`);\n const items: any[] = [];\n for (const v of data.vulnerabilities ?? []) {\n const added = parseDate(v.dateAdded);\n if (added < cutoff) continue;\n const hay =\n `${v.vendorProject} ${v.product} ${v.vulnerabilityName} ${v.shortDescription}`.toLowerCase();\n const relevant = VENDOR_KEYWORDS.some((k) => hay.includes(k));\n items.push({\n cve: v.cveID,\n vendor: v.vendorProject,\n product: v.product,\n name: v.vulnerabilityName,\n added: v.dateAdded,\n due: v.dueDate,\n ransomware: v.knownRansomwareCampaignUse,\n relevant,\n });\n }\n // Insurer-relevant first, then most recent.\n items.sort(\n (a, b) =>\n Number(b.relevant) - Number(a.relevant) ||\n parseDate(b.added).getTime() - parseDate(a.added).getTime(),\n );\n return items;\n}\n\nasync function fetchVictims(cutoff: Date) {\n let arr: any[] = [];\n let lastErr: unknown;\n for (const url of RANSOM_URLS) {\n try {\n const res = await fetch(url, { headers: { accept: \"application/json\" } });\n if (!res.ok) throw new Error(`HTTP ${res.status}`);\n const data = await res.json();\n arr = Array.isArray(data) ? data : (data.data ?? data.victims ?? []);\n if (arr.length) break;\n } catch (e) {\n lastErr = e;\n }\n }\n if (!arr.length && lastErr) console.error(\"ransomware feed failed:\", lastErr);\n\n const hits: any[] = [];\n for (const v of arr) {\n const when = parseDate(v.discovered ?? v.published ?? v.attackdate);\n if (when < cutoff) continue;\n const hay =\n `${v.post_title ?? v.victim ?? \"\"} ${v.activity ?? \"\"} ${v.description ?? \"\"}`\n .toLowerCase();\n if (!SECTOR_KEYWORDS.some((k) => hay.includes(k))) continue;\n hits.push({\n victim: v.post_title ?? v.victim ?? \"(unknown)\",\n group: v.group_name ?? v.group ?? \"?\",\n activity: v.activity ?? \"\",\n country: v.country ?? \"\",\n discovered: v.discovered ?? v.published ?? v.attackdate ?? \"\",\n });\n }\n return hits;\n}\n\nfunction buildHtml(kev: any[], victims: any[], since: Date) {\n const relevantKev = kev.filter((k) => k.relevant);\n const otherKev = kev.filter((k) => !k.relevant);\n const today = new Date().toISOString().slice(0, 10);\n\n const kevRow = (k: any) => `\n \n \n ${esc(k.cve)}\n ${esc(k.vendor)} ${esc(k.product)}
\n ${esc(k.name)}\n ${k.ransomware && k.ransomware !== \"Unknown\" ? ` [ransomware use]` : \"\"}\n added ${esc(k.added)}
due ${esc(k.due ?? \"-\")}\n `;\n\n const victimRow = (v: any) => `\n \n ${esc(v.victim)}\n ${v.activity ? `
${esc(v.activity)}` : \"\"}\n ${esc(v.group)}\n ${esc(v.country)}
${esc(v.discovered)}\n `;\n\n const section = (title: string, rows: string, empty: string) => `\n

${title}

\n ${rows\n ? `${rows}

`\n : `

${empty}

`}`;\n\n return `\n

🛡️ Insurance-Sector CTI Digest — ${today}

\n New items since ${since.toISOString().slice(0, 10)} · Sources: CISA KEV, ransomware.live.\n Automated feed digest — verify before acting.

\n\n ${section(\n `⚠️ Actively-exploited CVEs in insurer-relevant software (${relevantKev.length})`,\n relevantKev.map(kevRow).join(\"\"),\n \"No new insurer-relevant KEV entries in the window.\",\n )}\n\n ${section(\n `🏢 Ransomware victims in insurance / finance (${victims.length})`,\n victims.map(victimRow).join(\"\"),\n \"No new insurance/finance-sector ransomware victims reported in the window.\",\n )}\n\n ${section(\n `📋 Other new KEV additions (${otherKev.length})`,\n otherKev.slice(0, 15).map(kevRow).join(\"\"),\n \"None.\",\n )}\n

\n Generated by your Val Town cti-daily-digest job.

`;\n}\n\nexport default async function (interval: Interval) {\n const since = interval?.lastRunAt\n ? new Date(interval.lastRunAt)\n : daysAgo(LOOKBACK_DAYS);\n // Never look back more than LOOKBACK_DAYS even if the job was paused a long time.\n const cutoff = new Date(\n Math.max(since.getTime(), daysAgo(LOOKBACK_DAYS).getTime()),\n );\n\n let kev: any[] = [];\n let victims: any[] = [];\n try {\n kev = await fetchKev(cutoff);\n } catch (e) {\n console.error(\"KEV fetch failed:\", e);\n }\n try {\n victims = await fetchVictims(cutoff);\n } catch (e) {\n console.error(\"victim fetch failed:\", e);\n }\n\n const relevantCount = kev.filter((k) => k.relevant).length;\n console.log(\n `KEV total=${kev.length} insurer-relevant=${relevantCount} victims=${victims.length}`,\n );\n\n const html = buildHtml(kev, victims, cutoff);\n const subject =\n `CTI Digest ${new Date().toISOString().slice(0, 10)} — ` +\n `${relevantCount} relevant CVE(s), ${victims.length} sector victim(s)`;\n\n await email({\n subject,\n html,\n text:\n `Insurance-sector CTI digest.\\n` +\n `Insurer-relevant KEV: ${relevantCount}\\n` +\n `New KEV total: ${kev.length}\\n` +\n `Insurance/finance ransomware victims: ${victims.length}\\n` +\n `(HTML version has details.)`,\n });\n\n return { kev: kev.length, relevant: relevantCount, victims: victims.length };\n}\n","// Daily Cyber Threat Intelligence digest for the insurance / financial-services sector.\n// Pulls the CISA KEV catalog + a ransomware victim feed, filters for insurer-relevant\n// items, and emails the val owner a briefing. Runs on a cron schedule (interval val).\nimport { email } from \"https://esm.town/v/std/email\";\n\nconst KEV_URL =\n \"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json\";\n\n// ransomware.live changes endpoints occasionally; try newest first.\nconst RANSOM_URLS = [\n \"https://api.ransomware.live/v2/recentvictims\",\n \"https://api.ransomware.live/recentvictims\",\n];\n\nconst LOOKBACK_DAYS = 2; // Cap on how far back we look, even after a pause.\n\n// Enterprise software commonly used by large insurers — used to flag KEV entries.\nconst VENDOR_KEYWORDS = [\n \"fortinet\", \"forti\", \"citrix\", \"netscaler\", \"microsoft\", \"sharepoint\", \"exchange\",\n \"windows\", \"cisco\", \"vpn\", \"ivanti\", \"pulse\", \"palo alto\", \"paloalto\", \"globalprotect\",\n \"f5\", \"big-ip\", \"oracle\", \"moveit\", \"gofileroom\", \"goanywhere\", \"cleo\", \"sonicwall\",\n \"okta\", \"identity\", \"active directory\", \"adfs\", \"email gateway\", \"proofpoint\",\n \"mimecast\", \"vmware\", \"esxi\", \"veeam\", \"adobe coldfusion\", \"coldfusion\",\n];\n\n// Insurance / finance sector terms — used to flag ransomware victims.\nconst SECTOR_KEYWORDS = [\n \"insur\", \"assurance\", \"reinsur\", \"underwrit\", \"actuar\", \"annuity\", \"annuities\",\n \"financ\", \"bank\", \"credit union\", \"brokerage\", \"broker\", \"mutual\", \"wealth\",\n \"capital\", \"holdings\", \"indemnity\", \"casualty\", \"life insurance\",\n];\n\nfunction daysAgo(n: number): Date {\n return new Date(Date.now() - n * 86_400_000);\n}\n\nfunction parseDate(s: unknown): Date {\n if (!s) return new Date(0);\n // Feeds use \"2026-07-10 08:00:00.000000\"; normalise to ISO-ish.\n const iso = String(s).trim().replace(\" \", \"T\");\n const d = new Date(iso);\n return isNaN(d.getTime()) ? new Date(0) : d;\n}\n\nfunction esc(s: unknown): string {\n return String(s ?? \"\")\n .replace(/&/g, \"&\").replace(//g, \">\");\n}\n\nasync function fetchKev(cutoff: Date) {\n const res = await fetch(KEV_URL);\n console.log(`KEV fetch status=${res.status} ct=${res.headers.get(\"content-type\")}`);\n if (!res.ok) throw new Error(`KEV HTTP ${res.status}`);\n const data = await res.json();\n console.log(`KEV catalogVersion=${data.catalogVersion} count=${(data.vulnerabilities ?? []).length}`);\n const sample = (data.vulnerabilities ?? [])[0];\n console.log(`sample dateAdded=${sample?.dateAdded} parsed=${parseDate(sample?.dateAdded).toISOString()} cutoff=${cutoff.toISOString()} now=${new Date().toISOString()}`);\n const items: any[] = [];\n for (const v of data.vulnerabilities ?? []) {\n const added = parseDate(v.dateAdded);\n if (added < cutoff) continue;\n const hay =\n `${v.vendorProject} ${v.product} ${v.vulnerabilityName} ${v.shortDescription}`.toLowerCase();\n const relevant = VENDOR_KEYWORDS.some((k) => hay.includes(k));\n items.push({\n cve: v.cveID,\n vendor: v.vendorProject,\n product: v.product,\n name: v.vulnerabilityName,\n added: v.dateAdded,\n due: v.dueDate,\n ransomware: v.knownRansomwareCampaignUse,\n relevant,\n });\n }\n // Insurer-relevant first, then most recent.\n items.sort(\n (a, b) =>\n Number(b.relevant) - Number(a.relevant) ||\n parseDate(b.added).getTime() - parseDate(a.added).getTime(),\n );\n return items;\n}\n\nasync function fetchVictims(cutoff: Date) {\n let arr: any[] = [];\n let lastErr: unknown;\n for (const url of RANSOM_URLS) {\n try {\n const res = await fetch(url, { headers: { accept: \"application/json\" } });\n if (!res.ok) throw new Error(`HTTP ${res.status}`);\n const data = await res.json();\n arr = Array.isArray(data) ? data : (data.data ?? data.victims ?? []);\n if (arr.length) break;\n } catch (e) {\n lastErr = e;\n }\n }\n if (!arr.length && lastErr) console.error(\"ransomware feed failed:\", lastErr);\n\n const hits: any[] = [];\n for (const v of arr) {\n const when = parseDate(v.discovered ?? v.published ?? v.attackdate);\n if (when < cutoff) continue;\n const hay =\n `${v.post_title ?? v.victim ?? \"\"} ${v.activity ?? \"\"} ${v.description ?? \"\"}`\n .toLowerCase();\n if (!SECTOR_KEYWORDS.some((k) => hay.includes(k))) continue;\n hits.push({\n victim: v.post_title ?? v.victim ?? \"(unknown)\",\n group: v.group_name ?? v.group ?? \"?\",\n activity: v.activity ?? \"\",\n country: v.country ?? \"\",\n discovered: v.discovered ?? v.published ?? v.attackdate ?? \"\",\n });\n }\n return hits;\n}\n\nfunction buildHtml(kev: any[], victims: any[], since: Date) {\n const relevantKev = kev.filter((k) => k.relevant);\n const otherKev = kev.filter((k) => !k.relevant);\n const today = new Date().toISOString().slice(0, 10);\n\n const kevRow = (k: any) => `\n \n \n ${esc(k.cve)}\n ${esc(k.vendor)} ${esc(k.product)}
\n ${esc(k.name)}\n ${k.ransomware && k.ransomware !== \"Unknown\" ? ` [ransomware use]` : \"\"}\n added ${esc(k.added)}
due ${esc(k.due ?? \"-\")}\n `;\n\n const victimRow = (v: any) => `\n \n ${esc(v.victim)}\n ${v.activity ? `
${esc(v.activity)}` : \"\"}\n ${esc(v.group)}\n ${esc(v.country)}
${esc(v.discovered)}\n `;\n\n const section = (title: string, rows: string, empty: string) => `\n

${title}

\n ${rows\n ? `${rows}

`\n : `

${empty}

`}`;\n\n return `\n

🛡️ Insurance-Sector CTI Digest — ${today}

\n New items since ${since.toISOString().slice(0, 10)} · Sources: CISA KEV, ransomware.live.\n Automated feed digest — verify before acting.

\n Generated by your Val Town cti-daily-digest job.

`;\n}\n\nexport default async function (interval: Interval) {\n const since = interval?.lastRunAt\n ? new Date(interval.lastRunAt)\n : daysAgo(LOOKBACK_DAYS);\n // Never look back more than LOOKBACK_DAYS even if the job was paused a long time.\n const cutoff = daysAgo(30); // TEMP test override\n\n let kev: any[] = [];\n let victims: any[] = [];\n try {\n kev = await fetchKev(cutoff);\n } catch (e) {\n console.error(\"KEV fetch failed:\", e);\n }\n try {\n victims = await fetchVictims(cutoff);\n } catch (e) {\n console.error(\"victim fetch failed:\", e);\n }\n\n const relevantCount = kev.filter((k) => k.relevant).length;\n console.log(\n `KEV total=${kev.length} insurer-relevant=${relevantCount} victims=${victims.length}`,\n );\n\n const html = buildHtml(kev, victims, cutoff);\n const subject =\n `CTI Digest ${new Date().toISOString().slice(0, 10)} — ` +\n `${relevantCount} relevant CVE(s), ${victims.length} sector victim(s)`;\n\n await email({\n subject,\n html,\n text:\n `Insurance-sector CTI digest.\\n` +\n `Insurer-relevant KEV: ${relevantCount}\\n` +\n `New KEV total: ${kev.length}\\n` +\n `Insurance/finance ransomware victims: ${victims.length}\\n` +\n `(HTML version has details.)`,\n });\n\n return { kev: kev.length, relevant: relevantCount, victims: victims.length };\n}\n","createdAt",["D",1783870616531],"branchVersion","branchId","5947c4bf-40c7-4704-8496-babad86e33c1","id","d6330c13-e641-4ee2-813e-1f012a67cf8f","cti-daily-digest",["D",1783869100455],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Daily insurance CTI email digest","imageUrl","9589d6cd-4e7f-4fc9-b59f-87d1fd0a10c8","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f56af-031e-75d4-8c5c-c45846cd4c86","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_95":94,"_103":99},"org",{"_95":94,"_96":97,"_98":99,"_18":55,"_100":101,"_102":25},"branch",{"_13":84,"_32":85,"_43":42,"_86":44,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":45,"_93":94},"isOwned",20,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","ernharth","handle","displayName","-Stephen","avatar","https://lh3.googleusercontent.com/a/ACg8ocJ31wz1zxZLxXTM7FyodyM-_qHIea6xtFLrKrgIA5R4lmptmw=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":150,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":151,"_79":152,"_81":153,"_83":25},"tree",[145],"files",[145],"counts",{"_134":61,"_135":136,"_137":61,"_138":139,"_140":141},"contents",[126],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":127,"_32":28,"_30":31,"_128":-5,"_41":42,"_40":14,"_129":25,"_38":130,"_13":131,"_33":34,"_35":37,"_24":25,"_132":-5,"_27":133},"54b77552-9cff-48c3-af0e-684c8e7d207f","parentId","latest",["D",1783870616531],7,"label",[28],"pulls","branches",1,"forks","envVars",{"_142":61,"_144":61},"connections",{"_142":61,"_143":61},"count","unfilledCount","emptyCount",{"_43":127,"_32":28,"_30":31,"_128":-5,"_41":42,"_40":14,"_129":25,"_38":146,"_13":131,"_33":34,"_35":37,"_24":25,"_132":-5,"_147":148,"_27":149},["D",1783870616531],"children",[],[28],["D",1783869100455],{"_95":94,"_103":99},{"_95":94,"_96":97,"_98":99,"_18":55,"_100":101,"_102":25},{"_13":84,"_32":85,"_43":42,"_86":44,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":45,"_93":94},"ctx",{"_77":-5,"_123":187,"_188":189,"_190":191,"_192":25,"_193":25,"_194":25,"_195":196,"_197":-5,"_198":-7,"_199":-7,"_200":61,"_201":25,"_202":25,"_203":-5,"_204":25,"_205":25,"_206":25,"_207":-5},"ENV",{"_158":159,"_160":161,"_162":85,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","811aa22498c9b0b5a47e8d778de579cdb990f332","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets",true,"preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v8