@highflame/policy 2.2.11 → 2.2.23

package/_schemas/ai_gateway/templates/templates.json

@@ -178,19 +178,6 @@
         "compliance:pci-dss",
         "compliance:hipaa"
       ]
-    },
-    {
-      "id": "organization.permit-llm-default",
-      "name": "Permit LLM proxy calls",
-      "description": "Permit all LLM chat completion requests by default; deploy alongside threat-specific forbids for a permit-default posture.",
-      "category": "organization",
-      "file": "llm_default_allow.cedar",
-      "severity": "low",
-      "tags": [
-        "category:organization",
-        "surface:process-prompt",
-        "posture:permit-default"
-      ]
     }
   ]
 }

package/_schemas/guardrails/context.json

@@ -283,6 +283,42 @@
           "required": false,
           "description": "Risk score for cross-origin escalation (0-100). Higher scores indicate more suspicious cross-boundary activity"
         },
+        {
+          "key": "package_install_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the event contains a recognized package install/download command (pip, npm, yarn, pnpm, bun, uv, gem, cargo, go, composer)"
+        },
+        {
+          "key": "packages_checked",
+          "type": "number",
+          "required": false,
+          "description": "Number of unique packages checked against the osv.dev database for this event"
+        },
+        {
+          "key": "malicious_package_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether any referenced package has a known-malicious OSV advisory (OpenSSF MAL- ID). Use to block supply-chain attacks at install time"
+        },
+        {
+          "key": "malicious_package_score",
+          "type": "number",
+          "required": false,
+          "description": "100 when a malicious package was detected, 0 otherwise"
+        },
+        {
+          "key": "malicious_packages",
+          "type": "array",
+          "required": false,
+          "description": "Malicious packages as ecosystem/name[@version] strings (e.g. 'PyPI/evil-pkg@1.0.0')"
+        },
+        {
+          "key": "package_check_status",
+          "type": "string",
+          "required": false,
+          "description": "Set to 'degraded' when the osv.dev lookup failed and packages could not be verified (fail-open). Combine with package_install_detected to fail closed"
+        },
         {
           "key": "encoded_content_detected",
           "type": "boolean",
@@ -949,6 +985,42 @@
           "required": false,
           "description": "Risk score for cross-origin escalation in tool calls (0-100)"
         },
+        {
+          "key": "package_install_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the event contains a recognized package install/download command (pip, npm, yarn, pnpm, bun, uv, gem, cargo, go, composer)"
+        },
+        {
+          "key": "packages_checked",
+          "type": "number",
+          "required": false,
+          "description": "Number of unique packages checked against the osv.dev database for this event"
+        },
+        {
+          "key": "malicious_package_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether any referenced package has a known-malicious OSV advisory (OpenSSF MAL- ID). Use to block supply-chain attacks at install time"
+        },
+        {
+          "key": "malicious_package_score",
+          "type": "number",
+          "required": false,
+          "description": "100 when a malicious package was detected, 0 otherwise"
+        },
+        {
+          "key": "malicious_packages",
+          "type": "array",
+          "required": false,
+          "description": "Malicious packages as ecosystem/name[@version] strings (e.g. 'PyPI/evil-pkg@1.0.0')"
+        },
+        {
+          "key": "package_check_status",
+          "type": "string",
+          "required": false,
+          "description": "Set to 'degraded' when the osv.dev lookup failed and packages could not be verified (fail-open). Combine with package_install_detected to fail closed"
+        },
         {
           "key": "encoded_content_detected",
           "type": "boolean",

package/_schemas/guardrails/templates/defaults/malicious_package.cedar

@@ -0,0 +1,59 @@
+// =============================================================================
+// Malicious Package (Default)
+// =============================================================================
+// Blocks tool calls that install or download packages flagged as malicious
+// by the osv.dev database (OpenSSF MAL- advisories). The malicious_package
+// detector (Shield, Tier Slow) parses package-manager invocations (pip, npm,
+// yarn, pnpm, bun, uv, gem, cargo, go, composer) out of tool-call arguments
+// and checks each referenced package against the OSV batch API.
+//
+// Context keys consumed:
+//   - malicious_package_detected: Bool
+//   - package_install_detected:   Bool
+//   - package_check_status:       String ("" | "degraded")
+//
+// Compliance:
+//   - OWASP LLM03 (Supply Chain), OWASP ASI02
+//
+// Category:  agent-security
+// Namespace: Guardrails
+// =============================================================================
+
+@id("agent-security.block-malicious-package")
+@name("Block malicious package installs")
+@description("Blocks call_tool when a referenced package carries a known-malicious osv.dev (MAL-) advisory.")
+@severity("critical")
+@tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:call-tool,owasp:llm03,owasp:asi02")
+@reject_message("Package install blocked: the requested package is flagged as malicious in the osv.dev database.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has malicious_package_detected &&
+    context.malicious_package_detected == true
+};
+
+// Alternative (fail-closed): the detector fails OPEN by design — when the
+// OSV lookup is unavailable, installs proceed with package_check_status set
+// to "degraded". Uncomment to block package installs whenever they cannot be
+// verified, trading install availability for supply-chain certainty.
+//
+// @id("agent-security.block-unverified-package")
+// @name("Block unverified package installs")
+// @description("Blocks call_tool package installs when the malicious-package lookup is degraded.")
+// @severity("medium")
+// @tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:call-tool,owasp:llm03")
+// @reject_message("Package install blocked: the package could not be verified against the malicious-package database.")
+// forbid (
+//     principal,
+//     action == Guardrails::Action::"call_tool",
+//     resource
+// )
+// when {
+//     context has package_install_detected &&
+//     context.package_install_detected == true &&
+//     context has package_check_status &&
+//     context.package_check_status == "degraded"
+// };

package/_schemas/guardrails/templates/profiles/code_agent/supply_chain.cedar

@@ -2,14 +2,16 @@
 // Code Agent — Supply Chain Security
 // =============================================================================
 // Detects and blocks MCP server poisoning, indirect prompt injection from
-// tool outputs, credential theft chains, and destructive operation sequences.
+// tool outputs, credential theft chains, destructive operation sequences,
+// and installs of packages with known-malicious (MAL-) osv.dev advisories.
 //
 // Context keys consumed:
-//   - tool_poisoning_score:      Long (0-100)
-//   - indirect_injection_score:  Long (0-100)
-//   - tool_is_sensitive:         Bool
-//   - suspicious_pattern:        Bool
-//   - pattern_type:              String
+//   - tool_poisoning_score:       Long (0-100)
+//   - indirect_injection_score:   Long (0-100)
+//   - tool_is_sensitive:          Bool
+//   - suspicious_pattern:         Bool
+//   - pattern_type:               String
+//   - malicious_package_detected: Bool
 //
 // Compliance:
 //   - OWASP ASI01, ASI02, ASI04, LLM01 (indirect), MCP01–05
@@ -96,3 +98,19 @@ when {
     context has suspicious_pattern && context.suspicious_pattern == true &&
     context has pattern_type && context.pattern_type == "destructive_sequence"
 };
+
+@id("agent-security.code-block-malicious-package")
+@name("Block malicious package installs (code profile)")
+@description("Blocks call_tool when a referenced package carries a known-malicious osv.dev (MAL-) advisory.")
+@severity("critical")
+@tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:call-tool,owasp:llm03,owasp:asi02")
+@reject_message("Package install blocked: the requested package is flagged as malicious in the osv.dev database.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has malicious_package_detected &&
+    context.malicious_package_detected == true
+};

package/_schemas/guardrails/templates/templates.json

@@ -151,6 +151,20 @@
         "owasp:asi02"
       ]
     },
+    {
+      "id": "agent-security.malicious-package",
+      "name": "Malicious Package",
+      "description": "Block package installs (pip, npm, yarn, pnpm, bun, uv, gem, cargo, go, composer) flagged as malicious.",
+      "category": "agent-security",
+      "file": "defaults/malicious_package.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-security",
+        "threat:supply-chain",
+        "owasp:llm03",
+        "owasp:asi02"
+      ]
+    },
     {
       "id": "agent-security.defaults",
       "name": "Agentic Safety",
@@ -292,7 +306,7 @@
     {
       "id": "agent-security.code-agent-supply-chain",
       "name": "Code Agent — Supply Chain",
-      "description": "Block MCP server poisoning, indirect prompt injection, credential theft chains, and destructive sequences for coding agents.",
+      "description": "Block MCP server poisoning, indirect prompt injection, credential theft chains, destructive sequences, and malicious package installs for coding agents.",
       "category": "agent-security",
       "file": "profiles/code_agent/supply_chain.cedar",
       "severity": "critical",

package/dist/ai_gateway-defaults.gen.js

@@ -1299,28 +1299,6 @@ when {
     )
 };
 `;
-const AI_GATEWAY_ORGANIZATION_PERMIT_LLM_DEFAULT_CEDAR = `// =============================================================================
-// LLM Default Allow
-// =============================================================================
-// Permits all LLM prompt processing by default. Deploy alongside threat-specific
-// forbid policies to create a "default allow, block on threat" posture for LLM
-// chat completions.
-//
-// Category:  organization
-// Namespace: AIGateway
-// =============================================================================
-
-@id("organization.permit-llm-default")
-@name("Permit LLM proxy calls")
-@description("Permits all process_prompt actions for the LLM proxy.")
-@severity("low")
-@tags("category:organization,surface:process-prompt,posture:permit-default")
-permit (
-    principal,
-    action == AIGateway::Action::"process_prompt",
-    resource
-);
-`;
 // =============================================================================
 // CATEGORIES
 // =============================================================================
@@ -1442,15 +1420,6 @@ export const AI_GATEWAY_TEMPLATES = [
         severity: 'critical',
         tags: ['category:privacy', 'threat:pii', 'detection:pattern', 'compliance:pci-dss', 'compliance:hipaa'],
     },
-    {
-        id: 'organization.permit-llm-default',
-        name: 'Permit LLM proxy calls',
-        description: 'Permit all LLM chat completion requests by default; deploy alongside threat-specific forbids for a permit-default posture.',
-        category: 'organization',
-        cedarText: AI_GATEWAY_ORGANIZATION_PERMIT_LLM_DEFAULT_CEDAR,
-        severity: 'low',
-        tags: ['category:organization', 'surface:process-prompt', 'posture:permit-default'],
-    },
 ];
 // =============================================================================
 // TEMPLATES METADATA
@@ -1636,19 +1605,6 @@ export const AI_GATEWAY_TEMPLATES_JSON = `{
         "compliance:pci-dss",
         "compliance:hipaa"
       ]
-    },
-    {
-      "id": "organization.permit-llm-default",
-      "name": "Permit LLM proxy calls",
-      "description": "Permit all LLM chat completion requests by default; deploy alongside threat-specific forbids for a permit-default posture.",
-      "category": "organization",
-      "file": "llm_default_allow.cedar",
-      "severity": "low",
-      "tags": [
-        "category:organization",
-        "surface:process-prompt",
-        "posture:permit-default"
-      ]
     }
   ]
 }

package/dist/guardrails-context.gen.d.ts

@@ -61,6 +61,9 @@ export declare const GuardrailsContextKey: {
     readonly LoopCount: "loop_count";
     readonly LoopDetected: "loop_detected";
     readonly LoopTool: "loop_tool";
+    readonly MaliciousPackageDetected: "malicious_package_detected";
+    readonly MaliciousPackageScore: "malicious_package_score";
+    readonly MaliciousPackages: "malicious_packages";
     readonly McpConfigRisk: "mcp_config_risk";
     readonly McpRiskScore: "mcp_risk_score";
     readonly McpRiskType: "mcp_risk_type";
@@ -68,6 +71,9 @@ export declare const GuardrailsContextKey: {
     readonly McpServerVerified: "mcp_server_verified";
     readonly McpTool: "mcp_tool";
     readonly MultiTurnDetection: "multi_turn_detection";
+    readonly PackageCheckStatus: "package_check_status";
+    readonly PackageInstallDetected: "package_install_detected";
+    readonly PackagesChecked: "packages_checked";
     readonly ParamTypeViolation: "param_type_violation";
     readonly ParamTypeViolations: "param_type_violations";
     readonly Path: "path";
@@ -137,4 +143,4 @@ export type GuardrailsContextKey = (typeof GuardrailsContextKey)[keyof typeof Gu
  * The full set of authorable context attribute keys for Guardrails.
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
-export declare const GuardrailsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "detected_language", "detected_script", "detector_count", "direction", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "factuality_score", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "mcp_config_risk", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "multi_turn_detection", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal", "privilege_scope", "profanity_score", "request_id", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "suspicious_pattern", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "violence_score", "weapons_score"];
+export declare const GuardrailsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "detected_language", "detected_script", "detector_count", "direction", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "factuality_score", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "mcp_config_risk", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "multi_turn_detection", "package_check_status", "package_install_detected", "packages_checked", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal", "privilege_scope", "profanity_score", "request_id", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "suspicious_pattern", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "violence_score", "weapons_score"];

package/dist/guardrails-context.gen.js

@@ -63,6 +63,9 @@ export const GuardrailsContextKey = {
     LoopCount: 'loop_count',
     LoopDetected: 'loop_detected',
     LoopTool: 'loop_tool',
+    MaliciousPackageDetected: 'malicious_package_detected',
+    MaliciousPackageScore: 'malicious_package_score',
+    MaliciousPackages: 'malicious_packages',
     McpConfigRisk: 'mcp_config_risk',
     McpRiskScore: 'mcp_risk_score',
     McpRiskType: 'mcp_risk_type',
@@ -70,6 +73,9 @@ export const GuardrailsContextKey = {
     McpServerVerified: 'mcp_server_verified',
     McpTool: 'mcp_tool',
     MultiTurnDetection: 'multi_turn_detection',
+    PackageCheckStatus: 'package_check_status',
+    PackageInstallDetected: 'package_install_detected',
+    PackagesChecked: 'packages_checked',
     ParamTypeViolation: 'param_type_violation',
     ParamTypeViolations: 'param_type_violations',
     Path: 'path',
@@ -195,6 +201,9 @@ export const GuardrailsContextKeys = [
     GuardrailsContextKey.LoopCount,
     GuardrailsContextKey.LoopDetected,
     GuardrailsContextKey.LoopTool,
+    GuardrailsContextKey.MaliciousPackageDetected,
+    GuardrailsContextKey.MaliciousPackageScore,
+    GuardrailsContextKey.MaliciousPackages,
     GuardrailsContextKey.McpConfigRisk,
     GuardrailsContextKey.McpRiskScore,
     GuardrailsContextKey.McpRiskType,
@@ -202,6 +211,9 @@ export const GuardrailsContextKeys = [
     GuardrailsContextKey.McpServerVerified,
     GuardrailsContextKey.McpTool,
     GuardrailsContextKey.MultiTurnDetection,
+    GuardrailsContextKey.PackageCheckStatus,
+    GuardrailsContextKey.PackageInstallDetected,
+    GuardrailsContextKey.PackagesChecked,
     GuardrailsContextKey.ParamTypeViolation,
     GuardrailsContextKey.ParamTypeViolations,
     GuardrailsContextKey.Path,

package/dist/guardrails-defaults.gen.js

@@ -580,6 +580,66 @@ when {
     context has tool_risk_score && context.tool_risk_score >= 71
 };
 `;
+const GUARDRAILS_AGENT_SECURITY_MALICIOUS_PACKAGE_CEDAR = `// =============================================================================
+// Malicious Package (Default)
+// =============================================================================
+// Blocks tool calls that install or download packages flagged as malicious
+// by the osv.dev database (OpenSSF MAL- advisories). The malicious_package
+// detector (Shield, Tier Slow) parses package-manager invocations (pip, npm,
+// yarn, pnpm, bun, uv, gem, cargo, go, composer) out of tool-call arguments
+// and checks each referenced package against the OSV batch API.
+//
+// Context keys consumed:
+//   - malicious_package_detected: Bool
+//   - package_install_detected:   Bool
+//   - package_check_status:       String ("" | "degraded")
+//
+// Compliance:
+//   - OWASP LLM03 (Supply Chain), OWASP ASI02
+//
+// Category:  agent-security
+// Namespace: Guardrails
+// =============================================================================
+
+@id("agent-security.block-malicious-package")
+@name("Block malicious package installs")
+@description("Blocks call_tool when a referenced package carries a known-malicious osv.dev (MAL-) advisory.")
+@severity("critical")
+@tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:call-tool,owasp:llm03,owasp:asi02")
+@reject_message("Package install blocked: the requested package is flagged as malicious in the osv.dev database.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has malicious_package_detected &&
+    context.malicious_package_detected == true
+};
+
+// Alternative (fail-closed): the detector fails OPEN by design — when the
+// OSV lookup is unavailable, installs proceed with package_check_status set
+// to "degraded". Uncomment to block package installs whenever they cannot be
+// verified, trading install availability for supply-chain certainty.
+//
+// @id("agent-security.block-unverified-package")
+// @name("Block unverified package installs")
+// @description("Blocks call_tool package installs when the malicious-package lookup is degraded.")
+// @severity("medium")
+// @tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:call-tool,owasp:llm03")
+// @reject_message("Package install blocked: the package could not be verified against the malicious-package database.")
+// forbid (
+//     principal,
+//     action == Guardrails::Action::"call_tool",
+//     resource
+// )
+// when {
+//     context has package_install_detected &&
+//     context.package_install_detected == true &&
+//     context has package_check_status &&
+//     context.package_check_status == "degraded"
+// };
+`;
 const GUARDRAILS_AGENT_SECURITY_DEFAULTS_CEDAR = `// =============================================================================
 // Agentic Safety (Default)
 // =============================================================================
@@ -1595,14 +1655,16 @@ const GUARDRAILS_AGENT_SECURITY_CODE_AGENT_SUPPLY_CHAIN_CEDAR = `// ============
 // Code Agent — Supply Chain Security
 // =============================================================================
 // Detects and blocks MCP server poisoning, indirect prompt injection from
-// tool outputs, credential theft chains, and destructive operation sequences.
+// tool outputs, credential theft chains, destructive operation sequences,
+// and installs of packages with known-malicious (MAL-) osv.dev advisories.
 //
 // Context keys consumed:
-//   - tool_poisoning_score:      Long (0-100)
-//   - indirect_injection_score:  Long (0-100)
-//   - tool_is_sensitive:         Bool
-//   - suspicious_pattern:        Bool
-//   - pattern_type:              String
+//   - tool_poisoning_score:       Long (0-100)
+//   - indirect_injection_score:   Long (0-100)
+//   - tool_is_sensitive:          Bool
+//   - suspicious_pattern:         Bool
+//   - pattern_type:               String
+//   - malicious_package_detected: Bool
 //
 // Compliance:
 //   - OWASP ASI01, ASI02, ASI04, LLM01 (indirect), MCP01–05
@@ -1689,6 +1751,22 @@ when {
     context has suspicious_pattern && context.suspicious_pattern == true &&
     context has pattern_type && context.pattern_type == "destructive_sequence"
 };
+
+@id("agent-security.code-block-malicious-package")
+@name("Block malicious package installs (code profile)")
+@description("Blocks call_tool when a referenced package carries a known-malicious osv.dev (MAL-) advisory.")
+@severity("critical")
+@tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:call-tool,owasp:llm03,owasp:asi02")
+@reject_message("Package install blocked: the requested package is flagged as malicious in the osv.dev database.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has malicious_package_detected &&
+    context.malicious_package_detected == true
+};
 `;
 const GUARDRAILS_DATA_PROTECTION_DATA_PIPELINE_CEDAR = `// =============================================================================
 // Data Pipeline — Data Protection (Secrets)
@@ -3436,6 +3514,15 @@ export const GUARDRAILS_TEMPLATES = [
         severity: 'critical',
         tags: ['category:agent-security', 'threat:command-injection', 'owasp:llm06', 'owasp:asi02'],
     },
+    {
+        id: 'agent-security.malicious-package',
+        name: 'Malicious Package',
+        description: 'Block package installs (pip, npm, yarn, pnpm, bun, uv, gem, cargo, go, composer) flagged as malicious.',
+        category: 'agent-security',
+        cedarText: GUARDRAILS_AGENT_SECURITY_MALICIOUS_PACKAGE_CEDAR,
+        severity: 'critical',
+        tags: ['category:agent-security', 'threat:supply-chain', 'owasp:llm03', 'owasp:asi02'],
+    },
     {
         id: 'agent-security.defaults',
         name: 'Agentic Safety',
@@ -3538,7 +3625,7 @@ export const GUARDRAILS_TEMPLATES = [
     {
         id: 'agent-security.code-agent-supply-chain',
         name: 'Code Agent — Supply Chain',
-        description: 'Block MCP server poisoning, indirect prompt injection, credential theft chains, and destructive sequences for coding agents.',
+        description: 'Block MCP server poisoning, indirect prompt injection, credential theft chains, destructive sequences, and malicious package installs for coding agents.',
         category: 'agent-security',
         cedarText: GUARDRAILS_AGENT_SECURITY_CODE_AGENT_SUPPLY_CHAIN_CEDAR,
         severity: 'critical',
@@ -3828,6 +3915,20 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
         "owasp:asi02"
       ]
     },
+    {
+      "id": "agent-security.malicious-package",
+      "name": "Malicious Package",
+      "description": "Block package installs (pip, npm, yarn, pnpm, bun, uv, gem, cargo, go, composer) flagged as malicious.",
+      "category": "agent-security",
+      "file": "defaults/malicious_package.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-security",
+        "threat:supply-chain",
+        "owasp:llm03",
+        "owasp:asi02"
+      ]
+    },
     {
       "id": "agent-security.defaults",
       "name": "Agentic Safety",
@@ -3969,7 +4070,7 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
     {
       "id": "agent-security.code-agent-supply-chain",
       "name": "Code Agent — Supply Chain",
-      "description": "Block MCP server poisoning, indirect prompt injection, credential theft chains, and destructive sequences for coding agents.",
+      "description": "Block MCP server poisoning, indirect prompt injection, credential theft chains, destructive sequences, and malicious package installs for coding agents.",
       "category": "agent-security",
       "file": "profiles/code_agent/supply_chain.cedar",
       "severity": "critical",

package/dist/guardrails-detectors.gen.js

@@ -378,6 +378,20 @@ export const GUARDRAILS_DETECTORS = [
         defendsAgainst: ["phishing"],
         exampleAttacks: [{ title: "Lookalike login URL", vulnerabilityId: "financial_fraud_facilitation", snippet: "Verify your account at http://paypa1-secure-login.example.", expectedSignal: {} }],
     },
+    {
+        id: "malicious_package",
+        displayName: "Malicious Package (OSV)",
+        category: "tool_safety",
+        stability: "preview",
+        tier: "slow",
+        inhouse: false,
+        model: null,
+        latencyP50Ms: 250,
+        emits: [{ name: "package_install_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff a package install/download command was recognized in the event." }, { name: "packages_checked", type: "Long", modifiable: false, semantic: "count", description: "Number of unique packages checked against osv.dev." }, { name: "malicious_package_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff any referenced package has a known-malicious (MAL-) OSV advisory." }, { name: "malicious_package_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "100 when a malicious package was detected, 0 otherwise." }, { name: "malicious_packages", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Malicious packages as ecosystem/name[@version] strings." }, { name: "package_check_status", type: "String", modifiable: false, semantic: "category_label", description: "Set to 'degraded' when the osv.dev lookup failed (fail-open); empty otherwise." }],
+        supportedModes: ["enforce", "monitor", "alert"],
+        defendsAgainst: ["supply_chain"],
+        exampleAttacks: [{ title: "Typosquatted PyPI package install", vulnerabilityId: "supply_chain", snippet: "pip install reqeusts", expectedSignal: {} }],
+    },
     {
         id: "sentiment",
         displayName: "Sentiment Analysis",
@@ -482,6 +496,9 @@ export const GUARDRAILS_FIELD_TO_DETECTORS = {
     "loop_count": ["loop_detector"],
     "loop_detected": ["loop_detector"],
     "loop_tool": ["loop_detector"],
+    "malicious_package_detected": ["malicious_package"],
+    "malicious_package_score": ["malicious_package"],
+    "malicious_packages": ["malicious_package"],
     "mcp_config_risk": ["mcp_risk"],
     "mcp_risk_score": ["mcp_risk"],
     "mcp_risk_type": ["mcp_risk"],
@@ -492,6 +509,9 @@ export const GUARDRAILS_FIELD_TO_DETECTORS = {
     "mip_label_name": ["file_metadata"],
     "multi_turn_detection": ["deepcontext"],
     "non_ascii_score": ["security"],
+    "package_check_status": ["malicious_package"],
+    "package_install_detected": ["malicious_package"],
+    "packages_checked": ["malicious_package"],
     "path_traversal_detected": ["path_traversal"],
     "path_traversal_severity": ["path_traversal"],
     "path_traversal_type": ["path_traversal"],

package/dist/service-schemas.gen.js

@@ -3584,6 +3584,12 @@ export const GUARDRAILS_CONTEXT = {
                 { "key": "cross_origin_detected", "type": "boolean", "required": false, "description": "Whether cross-origin escalation patterns were detected (tool calls or references crossing trust boundaries)" },
                 { "key": "cross_origin_type", "type": "string", "required": false, "description": "Type of cross-origin escalation: \'cross_origin_tool\', \'cross_origin_server\', or \'none\'" },
                 { "key": "cross_origin_score", "type": "number", "required": false, "description": "Risk score for cross-origin escalation (0-100). Higher scores indicate more suspicious cross-boundary activity" },
+                { "key": "package_install_detected", "type": "boolean", "required": false, "description": "Whether the event contains a recognized package install/download command (pip, npm, yarn, pnpm, bun, uv, gem, cargo, go, composer)" },
+                { "key": "packages_checked", "type": "number", "required": false, "description": "Number of unique packages checked against the osv.dev database for this event" },
+                { "key": "malicious_package_detected", "type": "boolean", "required": false, "description": "Whether any referenced package has a known-malicious OSV advisory (OpenSSF MAL- ID). Use to block supply-chain attacks at install time" },
+                { "key": "malicious_package_score", "type": "number", "required": false, "description": "100 when a malicious package was detected, 0 otherwise" },
+                { "key": "malicious_packages", "type": "array", "required": false, "description": "Malicious packages as ecosystem/name[@version] strings (e.g. \'PyPI/evil-pkg@1.0.0\')" },
+                { "key": "package_check_status", "type": "string", "required": false, "description": "Set to \'degraded\' when the osv.dev lookup failed and packages could not be verified (fail-open). Combine with package_install_detected to fail closed" },
                 { "key": "encoded_content_detected", "type": "boolean", "required": false, "description": "Whether encoded content was detected (base64, hex, unicode, URL encoding) that may hide malicious payloads" },
                 { "key": "encoded_types", "type": "array", "required": false, "description": "Array of encoding types detected (e.g., [\'base64\', \'hex\', \'unicode\', \'url\']). Use .contains() to check for specific encoding types" },
                 { "key": "encoded_count", "type": "number", "required": false, "description": "Number of encoded segments found in the content" },
@@ -3700,6 +3706,12 @@ export const GUARDRAILS_CONTEXT = {
                 { "key": "cross_origin_detected", "type": "boolean", "required": false, "description": "Whether cross-origin escalation patterns were detected in tool calls crossing trust boundaries" },
                 { "key": "cross_origin_type", "type": "string", "required": false, "description": "Type of cross-origin escalation detected in tool call" },
                 { "key": "cross_origin_score", "type": "number", "required": false, "description": "Risk score for cross-origin escalation in tool calls (0-100)" },
+                { "key": "package_install_detected", "type": "boolean", "required": false, "description": "Whether the event contains a recognized package install/download command (pip, npm, yarn, pnpm, bun, uv, gem, cargo, go, composer)" },
+                { "key": "packages_checked", "type": "number", "required": false, "description": "Number of unique packages checked against the osv.dev database for this event" },
+                { "key": "malicious_package_detected", "type": "boolean", "required": false, "description": "Whether any referenced package has a known-malicious OSV advisory (OpenSSF MAL- ID). Use to block supply-chain attacks at install time" },
+                { "key": "malicious_package_score", "type": "number", "required": false, "description": "100 when a malicious package was detected, 0 otherwise" },
+                { "key": "malicious_packages", "type": "array", "required": false, "description": "Malicious packages as ecosystem/name[@version] strings (e.g. \'PyPI/evil-pkg@1.0.0\')" },
+                { "key": "package_check_status", "type": "string", "required": false, "description": "Set to \'degraded\' when the osv.dev lookup failed and packages could not be verified (fail-open). Combine with package_install_detected to fail closed" },
                 { "key": "encoded_content_detected", "type": "boolean", "required": false, "description": "Whether encoded content was detected in tool arguments (base64, hex, unicode encoding hiding payloads)" },
                 { "key": "encoded_types", "type": "array", "required": false, "description": "Array of encoding types detected in tool arguments (e.g., [\'base64\', \'hex\'])" },
                 { "key": "encoded_count", "type": "number", "required": false, "description": "Number of encoded segments found in tool arguments" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highflame/policy",
-  "version": "2.2.11",
+  "version": "2.2.23",
   "engines": {
     "node": ">=18"
   },

package/_schemas/ai_gateway/templates/llm_default_allow.cedar

@@ -1,21 +0,0 @@
-// =============================================================================
-// LLM Default Allow
-// =============================================================================
-// Permits all LLM prompt processing by default. Deploy alongside threat-specific
-// forbid policies to create a "default allow, block on threat" posture for LLM
-// chat completions.
-//
-// Category:  organization
-// Namespace: AIGateway
-// =============================================================================
-
-@id("organization.permit-llm-default")
-@name("Permit LLM proxy calls")
-@description("Permits all process_prompt actions for the LLM proxy.")
-@severity("low")
-@tags("category:organization,surface:process-prompt,posture:permit-default")
-permit (
-    principal,
-    action == AIGateway::Action::"process_prompt",
-    resource
-);