v1.4.0

v1.4.0

Two new events for the ClickFix and OAuth consent attack types.

New

• command_copied: on ClickFix pages. When the user clicks an element marked data-ats-copy-command, the library copies the command to the clipboard and sends the event with type: "command". The command comes from the attribute value, or from the element's text if the value is empty. The page then redirects to redirectUrl.
• consent_granted: on OAuth consent pages. When the user clicks an element marked data-ats-consent, the library sends the event with its data-scopes as type (e.g. "mail.read files.read"). It blocks the element's own action, so a submit button with the attribute no longer submits its form, then redirects to redirectUrl.
• Tutorial: both events get their own tutorial step in all 10 locales. A copied command ends with the malware lesson, granted consent with the permissions lesson.

<button data-ats-copy-command="cmd /c echo verified">Copy</button>
<button data-ats-consent data-scopes="mail.read files.read">Allow</button>

Changed

• button_clicked ignores elements that carry data-ats-copy-command or data-ats-consent, so a single click is never recorded twice. data-ignore still opts an element out.

Internal

• Unit tests now run with Vitest in jsdom (npm test).

Platform side: red-hafen, the stats writers and the reports count both events as affected. command_copied is recorded as infected damage. consent_granted damage depends on the scopes: mail scopes count as emails, anything else as sensitive.