fix: the function_diff in function_diff.js

[anupamme]

Summary

Fix high severity security issue in scripts/function_diff.js.

Vulnerability

Field	Value
ID	V-002
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-002
File	scripts/function_diff.js:29
Assessment	Likely exploitable

Description: The function_diff.js script uses SHA1 truncated to 12 hex characters (48 bits) for function identification. SHA1 is cryptographically broken, and truncation to 48 bits makes birthday-paradox collisions feasible with approximately 2^24 attempts.

Evidence

Exploitation scenario: An attacker with access to submit functions for differential analysis could craft different functions producing identical truncated hashes, potentially hiding malicious code changes from detection.

Scanner confirmation: multi_agent_ai rule V-002 flagged this pattern.

Threat Model Context

This is a Node.js command-line tool - exploitation requires the attacker to control the arguments, input files or environment the tool is run with.

Changes

• scripts/function_diff.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

---

Automated security fix by OrbisAI Security