@highflame/policy 2.2.23 → 2.2.24

package/_schemas/ai_gateway/context.json

@@ -372,6 +372,66 @@
           "type": "boolean",
           "required": false,
           "description": "Whether the TPM limit has been exceeded. Use this to enforce token rate limits via Cedar policy"
+        },
+        {
+          "key": "package_install_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the tool-call arguments contain a recognized package install command (pip, npm, cargo, go get, etc.)"
+        },
+        {
+          "key": "packages_checked",
+          "type": "number",
+          "required": false,
+          "description": "Number of unique packages checked against osv.dev for this tool call"
+        },
+        {
+          "key": "malicious_package_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether any referenced package has a known-malicious (MAL-) OSV advisory. Use to block supply-chain attacks at install time"
+        },
+        {
+          "key": "malicious_package_score",
+          "type": "number",
+          "required": false,
+          "description": "100 when a malicious package was detected, 0 otherwise"
+        },
+        {
+          "key": "malicious_packages",
+          "type": "array",
+          "required": false,
+          "description": "Malicious packages as ecosystem/name[@version] strings (e.g. 'PyPI/evil-pkg@1.0.0')"
+        },
+        {
+          "key": "package_names",
+          "type": "array",
+          "required": false,
+          "description": "Names of all packages parsed from the install command (without ecosystem prefix). Available even when the osv.dev lookup fails."
+        },
+        {
+          "key": "package_ecosystems",
+          "type": "array",
+          "required": false,
+          "description": "Unique package ecosystems seen in this tool call, e.g. ['PyPI', 'npm']. Useful for policies that restrict which ecosystems are permitted."
+        },
+        {
+          "key": "package_advisory_count",
+          "type": "number",
+          "required": false,
+          "description": "Total non-malicious OSV advisories (GHSA- / CVE-) found across all checked packages. Excludes MAL- entries counted in malicious_package_detected."
+        },
+        {
+          "key": "package_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory count for advisory-only packages; 0 when all packages are clean."
+        },
+        {
+          "key": "package_check_status",
+          "type": "string",
+          "required": false,
+          "description": "Set to 'degraded' when the osv.dev lookup failed and packages could not be verified (fail-open). Combine with package_install_detected to fail closed."
         }
       ]
     },
@@ -618,6 +678,66 @@
           "type": "boolean",
           "required": false,
           "description": "Whether the TPM limit has been exceeded. Use this to enforce token rate limits via Cedar policy"
+        },
+        {
+          "key": "package_install_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the server-connect arguments contain a recognized package install command"
+        },
+        {
+          "key": "packages_checked",
+          "type": "number",
+          "required": false,
+          "description": "Number of unique packages checked against osv.dev for this connection event"
+        },
+        {
+          "key": "malicious_package_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether any referenced package has a known-malicious (MAL-) OSV advisory"
+        },
+        {
+          "key": "malicious_package_score",
+          "type": "number",
+          "required": false,
+          "description": "100 when a malicious package was detected, 0 otherwise"
+        },
+        {
+          "key": "malicious_packages",
+          "type": "array",
+          "required": false,
+          "description": "Malicious packages as ecosystem/name[@version] strings"
+        },
+        {
+          "key": "package_names",
+          "type": "array",
+          "required": false,
+          "description": "Names of all packages parsed from install commands (without ecosystem prefix)"
+        },
+        {
+          "key": "package_ecosystems",
+          "type": "array",
+          "required": false,
+          "description": "Unique package ecosystems seen in this connection event"
+        },
+        {
+          "key": "package_advisory_count",
+          "type": "number",
+          "required": false,
+          "description": "Total non-malicious OSV advisories found across all checked packages"
+        },
+        {
+          "key": "package_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Graduated supply-chain risk score (0-100)"
+        },
+        {
+          "key": "package_check_status",
+          "type": "string",
+          "required": false,
+          "description": "Set to 'degraded' when the osv.dev lookup failed (fail-open)"
         }
       ]
     },

package/_schemas/guardrails/context.json

@@ -313,6 +313,30 @@
           "required": false,
           "description": "Malicious packages as ecosystem/name[@version] strings (e.g. 'PyPI/evil-pkg@1.0.0')"
         },
+        {
+          "key": "package_names",
+          "type": "array",
+          "required": false,
+          "description": "Names of all packages parsed from the install command (without ecosystem prefix), e.g. ['requests', 'left-pad']. Available even when the osv.dev lookup fails."
+        },
+        {
+          "key": "package_ecosystems",
+          "type": "array",
+          "required": false,
+          "description": "Unique package ecosystems seen in this event, e.g. ['PyPI', 'npm']. Useful for policy rules that restrict which ecosystems are permitted."
+        },
+        {
+          "key": "package_advisory_count",
+          "type": "number",
+          "required": false,
+          "description": "Total number of non-malicious OSV advisories (GHSA- / CVE- IDs) found across all checked packages. Excludes MAL- entries counted in malicious_package_detected."
+        },
+        {
+          "key": "package_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory_count for advisory-only packages; 0 when all packages are clean."
+        },
         {
           "key": "package_check_status",
           "type": "string",
@@ -1015,6 +1039,30 @@
           "required": false,
           "description": "Malicious packages as ecosystem/name[@version] strings (e.g. 'PyPI/evil-pkg@1.0.0')"
         },
+        {
+          "key": "package_names",
+          "type": "array",
+          "required": false,
+          "description": "Names of all packages parsed from the install command (without ecosystem prefix), e.g. ['requests', 'left-pad']. Available even when the osv.dev lookup fails."
+        },
+        {
+          "key": "package_ecosystems",
+          "type": "array",
+          "required": false,
+          "description": "Unique package ecosystems seen in this event, e.g. ['PyPI', 'npm']. Useful for policy rules that restrict which ecosystems are permitted."
+        },
+        {
+          "key": "package_advisory_count",
+          "type": "number",
+          "required": false,
+          "description": "Total number of non-malicious OSV advisories (GHSA- / CVE- IDs) found across all checked packages. Excludes MAL- entries counted in malicious_package_detected."
+        },
+        {
+          "key": "package_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory_count for advisory-only packages; 0 when all packages are clean."
+        },
         {
           "key": "package_check_status",
           "type": "string",

package/dist/ai_gateway-context.gen.d.ts

@@ -17,6 +17,9 @@ export declare const AiGatewayContextKey: {
     readonly JailbreakScore: "jailbreak_score";
     readonly LoopCount: "loop_count";
     readonly LoopDetected: "loop_detected";
+    readonly MaliciousPackageDetected: "malicious_package_detected";
+    readonly MaliciousPackageScore: "malicious_package_score";
+    readonly MaliciousPackages: "malicious_packages";
     readonly MaxThreatSeverity: "max_threat_severity";
     readonly McpConfigRisk: "mcp_config_risk";
     readonly McpRiskScore: "mcp_risk_score";
@@ -25,6 +28,13 @@ export declare const AiGatewayContextKey: {
     readonly McpTool: "mcp_tool";
     readonly ModelName: "model_name";
     readonly ModelProvider: "model_provider";
+    readonly PackageAdvisoryCount: "package_advisory_count";
+    readonly PackageCheckStatus: "package_check_status";
+    readonly PackageEcosystems: "package_ecosystems";
+    readonly PackageInstallDetected: "package_install_detected";
+    readonly PackageNames: "package_names";
+    readonly PackageRiskScore: "package_risk_score";
+    readonly PackagesChecked: "packages_checked";
     readonly PatternType: "pattern_type";
     readonly PiiCount: "pii_count";
     readonly PiiDetected: "pii_detected";
@@ -76,4 +86,4 @@ export type AiGatewayContextKey = (typeof AiGatewayContextKey)[keyof typeof AiGa
  * The full set of authorable context attribute keys for AiGateway.
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
-export declare const AiGatewayContextKeys: readonly ["content", "crime_score", "detected_threats", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_score", "loop_count", "loop_detected", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "model_name", "model_provider", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "tpm_exceeded", "tpm_remaining_pct", "violence_score", "weapons_score"];
+export declare const AiGatewayContextKeys: readonly ["content", "crime_score", "detected_threats", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_score", "loop_count", "loop_detected", "malicious_package_detected", "malicious_package_score", "malicious_packages", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "model_name", "model_provider", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "tpm_exceeded", "tpm_remaining_pct", "violence_score", "weapons_score"];

package/dist/ai_gateway-context.gen.js

@@ -19,6 +19,9 @@ export const AiGatewayContextKey = {
     JailbreakScore: 'jailbreak_score',
     LoopCount: 'loop_count',
     LoopDetected: 'loop_detected',
+    MaliciousPackageDetected: 'malicious_package_detected',
+    MaliciousPackageScore: 'malicious_package_score',
+    MaliciousPackages: 'malicious_packages',
     MaxThreatSeverity: 'max_threat_severity',
     McpConfigRisk: 'mcp_config_risk',
     McpRiskScore: 'mcp_risk_score',
@@ -27,6 +30,13 @@ export const AiGatewayContextKey = {
     McpTool: 'mcp_tool',
     ModelName: 'model_name',
     ModelProvider: 'model_provider',
+    PackageAdvisoryCount: 'package_advisory_count',
+    PackageCheckStatus: 'package_check_status',
+    PackageEcosystems: 'package_ecosystems',
+    PackageInstallDetected: 'package_install_detected',
+    PackageNames: 'package_names',
+    PackageRiskScore: 'package_risk_score',
+    PackagesChecked: 'packages_checked',
     PatternType: 'pattern_type',
     PiiCount: 'pii_count',
     PiiDetected: 'pii_detected',
@@ -90,6 +100,9 @@ export const AiGatewayContextKeys = [
     AiGatewayContextKey.JailbreakScore,
     AiGatewayContextKey.LoopCount,
     AiGatewayContextKey.LoopDetected,
+    AiGatewayContextKey.MaliciousPackageDetected,
+    AiGatewayContextKey.MaliciousPackageScore,
+    AiGatewayContextKey.MaliciousPackages,
     AiGatewayContextKey.MaxThreatSeverity,
     AiGatewayContextKey.McpConfigRisk,
     AiGatewayContextKey.McpRiskScore,
@@ -98,6 +111,13 @@ export const AiGatewayContextKeys = [
     AiGatewayContextKey.McpTool,
     AiGatewayContextKey.ModelName,
     AiGatewayContextKey.ModelProvider,
+    AiGatewayContextKey.PackageAdvisoryCount,
+    AiGatewayContextKey.PackageCheckStatus,
+    AiGatewayContextKey.PackageEcosystems,
+    AiGatewayContextKey.PackageInstallDetected,
+    AiGatewayContextKey.PackageNames,
+    AiGatewayContextKey.PackageRiskScore,
+    AiGatewayContextKey.PackagesChecked,
     AiGatewayContextKey.PatternType,
     AiGatewayContextKey.PiiCount,
     AiGatewayContextKey.PiiDetected,

package/dist/ai_gateway-detectors.gen.js

@@ -168,6 +168,20 @@ export const AI_GATEWAY_DETECTORS = [
         defendsAgainst: ["mcp_rug_pull"],
         exampleAttacks: [],
     },
+    {
+        id: "malicious_package",
+        displayName: "Malicious Package (OSV)",
+        category: "tool_safety",
+        stability: "preview",
+        tier: "slow",
+        inhouse: false,
+        model: null,
+        latencyP50Ms: 250,
+        emits: [{ name: "package_install_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff a package install/download command was recognized in the event." }, { name: "packages_checked", type: "Long", modifiable: false, semantic: "count", description: "Number of unique packages checked against osv.dev." }, { name: "malicious_package_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff any referenced package has a known-malicious (MAL-) OSV advisory." }, { name: "malicious_package_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "100 when a malicious package was detected, 0 otherwise." }, { name: "malicious_packages", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Malicious packages as ecosystem/name[@version] strings." }, { name: "package_names", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Names of all packages parsed from install commands (without ecosystem prefix), e.g. 'requests', 'left-pad'. Available even when the osv.dev lookup fails." }, { name: "package_ecosystems", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Unique package ecosystems seen in this event, e.g. 'PyPI', 'npm'. Useful for policies that restrict which ecosystems are permitted." }, { name: "package_advisory_count", type: "Long", modifiable: false, semantic: "count", description: "Total non-malicious OSV advisories (GHSA- / CVE- IDs) found across all checked packages. Excludes MAL- entries counted in malicious_package_detected." }, { name: "package_risk_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory_count for advisory-only packages; 0 when all packages are clean." }, { name: "package_check_status", type: "String", modifiable: false, semantic: "category_label", description: "Set to 'degraded' when the osv.dev lookup failed (fail-open); empty otherwise." }],
+        supportedModes: ["enforce", "monitor", "alert"],
+        defendsAgainst: ["supply_chain"],
+        exampleAttacks: [{ title: "Typosquatted PyPI install via MCP bash tool", vulnerabilityId: "supply_chain", snippet: "pip install reqeusts", expectedSignal: {} }],
+    },
 ];
 // Semantic field → contributing detector ids (producesAttrs + normalizationAliases,
 // resolved at codegen). Used by the client field→detector resolver — no Shield round-trip.
@@ -181,11 +195,21 @@ export const AI_GATEWAY_FIELD_TO_DETECTORS = {
     "jailbreak_score": ["injection"],
     "loop_count": ["loop_detector"],
     "loop_detected": ["loop_detector"],
+    "malicious_package_detected": ["malicious_package"],
+    "malicious_package_score": ["malicious_package"],
+    "malicious_packages": ["malicious_package"],
     "mcp_config_risk": ["mcp_risk"],
     "mcp_risk_score": ["mcp_risk"],
     "mcp_server": ["mcp_risk"],
     "mcp_server_verified": ["mcp_risk"],
     "mcp_tool": ["mcp_risk"],
+    "package_advisory_count": ["malicious_package"],
+    "package_check_status": ["malicious_package"],
+    "package_ecosystems": ["malicious_package"],
+    "package_install_detected": ["malicious_package"],
+    "package_names": ["malicious_package"],
+    "package_risk_score": ["malicious_package"],
+    "packages_checked": ["malicious_package"],
     "pattern_type": ["action_pattern"],
     "pii_count": ["pii"],
     "pii_detected": ["pii"],

package/dist/guardrails-context.gen.d.ts

@@ -71,8 +71,12 @@ export declare const GuardrailsContextKey: {
     readonly McpServerVerified: "mcp_server_verified";
     readonly McpTool: "mcp_tool";
     readonly MultiTurnDetection: "multi_turn_detection";
+    readonly PackageAdvisoryCount: "package_advisory_count";
     readonly PackageCheckStatus: "package_check_status";
+    readonly PackageEcosystems: "package_ecosystems";
     readonly PackageInstallDetected: "package_install_detected";
+    readonly PackageNames: "package_names";
+    readonly PackageRiskScore: "package_risk_score";
     readonly PackagesChecked: "packages_checked";
     readonly ParamTypeViolation: "param_type_violation";
     readonly ParamTypeViolations: "param_type_violations";
@@ -143,4 +147,4 @@ export type GuardrailsContextKey = (typeof GuardrailsContextKey)[keyof typeof Gu
  * The full set of authorable context attribute keys for Guardrails.
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
-export declare const GuardrailsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "detected_language", "detected_script", "detector_count", "direction", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "factuality_score", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "mcp_config_risk", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "multi_turn_detection", "package_check_status", "package_install_detected", "packages_checked", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal", "privilege_scope", "profanity_score", "request_id", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "suspicious_pattern", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "violence_score", "weapons_score"];
+export declare const GuardrailsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "detected_language", "detected_script", "detector_count", "direction", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "factuality_score", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "mcp_config_risk", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "multi_turn_detection", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal", "privilege_scope", "profanity_score", "request_id", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "suspicious_pattern", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "violence_score", "weapons_score"];

package/dist/guardrails-context.gen.js

@@ -73,8 +73,12 @@ export const GuardrailsContextKey = {
     McpServerVerified: 'mcp_server_verified',
     McpTool: 'mcp_tool',
     MultiTurnDetection: 'multi_turn_detection',
+    PackageAdvisoryCount: 'package_advisory_count',
     PackageCheckStatus: 'package_check_status',
+    PackageEcosystems: 'package_ecosystems',
     PackageInstallDetected: 'package_install_detected',
+    PackageNames: 'package_names',
+    PackageRiskScore: 'package_risk_score',
     PackagesChecked: 'packages_checked',
     ParamTypeViolation: 'param_type_violation',
     ParamTypeViolations: 'param_type_violations',
@@ -211,8 +215,12 @@ export const GuardrailsContextKeys = [
     GuardrailsContextKey.McpServerVerified,
     GuardrailsContextKey.McpTool,
     GuardrailsContextKey.MultiTurnDetection,
+    GuardrailsContextKey.PackageAdvisoryCount,
     GuardrailsContextKey.PackageCheckStatus,
+    GuardrailsContextKey.PackageEcosystems,
     GuardrailsContextKey.PackageInstallDetected,
+    GuardrailsContextKey.PackageNames,
+    GuardrailsContextKey.PackageRiskScore,
     GuardrailsContextKey.PackagesChecked,
     GuardrailsContextKey.ParamTypeViolation,
     GuardrailsContextKey.ParamTypeViolations,

package/dist/guardrails-detectors.gen.js

@@ -387,7 +387,7 @@ export const GUARDRAILS_DETECTORS = [
         inhouse: false,
         model: null,
         latencyP50Ms: 250,
-        emits: [{ name: "package_install_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff a package install/download command was recognized in the event." }, { name: "packages_checked", type: "Long", modifiable: false, semantic: "count", description: "Number of unique packages checked against osv.dev." }, { name: "malicious_package_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff any referenced package has a known-malicious (MAL-) OSV advisory." }, { name: "malicious_package_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "100 when a malicious package was detected, 0 otherwise." }, { name: "malicious_packages", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Malicious packages as ecosystem/name[@version] strings." }, { name: "package_check_status", type: "String", modifiable: false, semantic: "category_label", description: "Set to 'degraded' when the osv.dev lookup failed (fail-open); empty otherwise." }],
+        emits: [{ name: "package_install_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff a package install/download command was recognized in the event." }, { name: "packages_checked", type: "Long", modifiable: false, semantic: "count", description: "Number of unique packages checked against osv.dev." }, { name: "malicious_package_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff any referenced package has a known-malicious (MAL-) OSV advisory." }, { name: "malicious_package_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "100 when a malicious package was detected, 0 otherwise." }, { name: "malicious_packages", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Malicious packages as ecosystem/name[@version] strings." }, { name: "package_names", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Names of all packages parsed from install commands (without ecosystem prefix), e.g. 'requests', 'left-pad'. Available even when the osv.dev lookup fails." }, { name: "package_ecosystems", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Unique package ecosystems seen in this event, e.g. 'PyPI', 'npm'. Useful for policies that restrict which ecosystems are permitted." }, { name: "package_advisory_count", type: "Long", modifiable: false, semantic: "count", description: "Total non-malicious OSV advisories (GHSA- / CVE- IDs) found across all checked packages. Excludes MAL- entries counted in malicious_package_detected." }, { name: "package_risk_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory_count for advisory-only packages; 0 when all packages are clean." }, { name: "package_check_status", type: "String", modifiable: false, semantic: "category_label", description: "Set to 'degraded' when the osv.dev lookup failed (fail-open); empty otherwise." }],
         supportedModes: ["enforce", "monitor", "alert"],
         defendsAgainst: ["supply_chain"],
         exampleAttacks: [{ title: "Typosquatted PyPI package install", vulnerabilityId: "supply_chain", snippet: "pip install reqeusts", expectedSignal: {} }],
@@ -509,8 +509,12 @@ export const GUARDRAILS_FIELD_TO_DETECTORS = {
     "mip_label_name": ["file_metadata"],
     "multi_turn_detection": ["deepcontext"],
     "non_ascii_score": ["security"],
+    "package_advisory_count": ["malicious_package"],
     "package_check_status": ["malicious_package"],
+    "package_ecosystems": ["malicious_package"],
     "package_install_detected": ["malicious_package"],
+    "package_names": ["malicious_package"],
+    "package_risk_score": ["malicious_package"],
     "packages_checked": ["malicious_package"],
     "path_traversal_detected": ["path_traversal"],
     "path_traversal_severity": ["path_traversal"],

package/dist/service-schemas.gen.js

@@ -3346,7 +3346,17 @@ export const AI_GATEWAY_CONTEXT = {
                 { "key": "rpm_remaining_pct", "type": "number", "required": false, "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)" },
                 { "key": "rpm_exceeded", "type": "boolean", "required": false, "description": "Whether the RPM limit has been exceeded. Use this to enforce rate limits via Cedar policy" },
                 { "key": "tpm_remaining_pct", "type": "number", "required": false, "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)" },
-                { "key": "tpm_exceeded", "type": "boolean", "required": false, "description": "Whether the TPM limit has been exceeded. Use this to enforce token rate limits via Cedar policy" }
+                { "key": "tpm_exceeded", "type": "boolean", "required": false, "description": "Whether the TPM limit has been exceeded. Use this to enforce token rate limits via Cedar policy" },
+                { "key": "package_install_detected", "type": "boolean", "required": false, "description": "Whether the tool-call arguments contain a recognized package install command (pip, npm, cargo, go get, etc.)" },
+                { "key": "packages_checked", "type": "number", "required": false, "description": "Number of unique packages checked against osv.dev for this tool call" },
+                { "key": "malicious_package_detected", "type": "boolean", "required": false, "description": "Whether any referenced package has a known-malicious (MAL-) OSV advisory. Use to block supply-chain attacks at install time" },
+                { "key": "malicious_package_score", "type": "number", "required": false, "description": "100 when a malicious package was detected, 0 otherwise" },
+                { "key": "malicious_packages", "type": "array", "required": false, "description": "Malicious packages as ecosystem/name[@version] strings (e.g. \'PyPI/evil-pkg@1.0.0\')" },
+                { "key": "package_names", "type": "array", "required": false, "description": "Names of all packages parsed from the install command (without ecosystem prefix). Available even when the osv.dev lookup fails." },
+                { "key": "package_ecosystems", "type": "array", "required": false, "description": "Unique package ecosystems seen in this tool call, e.g. [\'PyPI\', \'npm\']. Useful for policies that restrict which ecosystems are permitted." },
+                { "key": "package_advisory_count", "type": "number", "required": false, "description": "Total non-malicious OSV advisories (GHSA- / CVE-) found across all checked packages. Excludes MAL- entries counted in malicious_package_detected." },
+                { "key": "package_risk_score", "type": "number", "required": false, "description": "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory count for advisory-only packages; 0 when all packages are clean." },
+                { "key": "package_check_status", "type": "string", "required": false, "description": "Set to \'degraded\' when the osv.dev lookup failed and packages could not be verified (fail-open). Combine with package_install_detected to fail closed." }
             ]
         },
         {
@@ -3392,7 +3402,17 @@ export const AI_GATEWAY_CONTEXT = {
                 { "key": "rpm_remaining_pct", "type": "number", "required": false, "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)" },
                 { "key": "rpm_exceeded", "type": "boolean", "required": false, "description": "Whether the RPM limit has been exceeded. Use this to enforce rate limits via Cedar policy" },
                 { "key": "tpm_remaining_pct", "type": "number", "required": false, "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)" },
-                { "key": "tpm_exceeded", "type": "boolean", "required": false, "description": "Whether the TPM limit has been exceeded. Use this to enforce token rate limits via Cedar policy" }
+                { "key": "tpm_exceeded", "type": "boolean", "required": false, "description": "Whether the TPM limit has been exceeded. Use this to enforce token rate limits via Cedar policy" },
+                { "key": "package_install_detected", "type": "boolean", "required": false, "description": "Whether the server-connect arguments contain a recognized package install command" },
+                { "key": "packages_checked", "type": "number", "required": false, "description": "Number of unique packages checked against osv.dev for this connection event" },
+                { "key": "malicious_package_detected", "type": "boolean", "required": false, "description": "Whether any referenced package has a known-malicious (MAL-) OSV advisory" },
+                { "key": "malicious_package_score", "type": "number", "required": false, "description": "100 when a malicious package was detected, 0 otherwise" },
+                { "key": "malicious_packages", "type": "array", "required": false, "description": "Malicious packages as ecosystem/name[@version] strings" },
+                { "key": "package_names", "type": "array", "required": false, "description": "Names of all packages parsed from install commands (without ecosystem prefix)" },
+                { "key": "package_ecosystems", "type": "array", "required": false, "description": "Unique package ecosystems seen in this connection event" },
+                { "key": "package_advisory_count", "type": "number", "required": false, "description": "Total non-malicious OSV advisories found across all checked packages" },
+                { "key": "package_risk_score", "type": "number", "required": false, "description": "Graduated supply-chain risk score (0-100)" },
+                { "key": "package_check_status", "type": "string", "required": false, "description": "Set to \'degraded\' when the osv.dev lookup failed (fail-open)" }
             ]
         },
         {
@@ -3589,6 +3609,10 @@ export const GUARDRAILS_CONTEXT = {
                 { "key": "malicious_package_detected", "type": "boolean", "required": false, "description": "Whether any referenced package has a known-malicious OSV advisory (OpenSSF MAL- ID). Use to block supply-chain attacks at install time" },
                 { "key": "malicious_package_score", "type": "number", "required": false, "description": "100 when a malicious package was detected, 0 otherwise" },
                 { "key": "malicious_packages", "type": "array", "required": false, "description": "Malicious packages as ecosystem/name[@version] strings (e.g. \'PyPI/evil-pkg@1.0.0\')" },
+                { "key": "package_names", "type": "array", "required": false, "description": "Names of all packages parsed from the install command (without ecosystem prefix), e.g. [\'requests\', \'left-pad\']. Available even when the osv.dev lookup fails." },
+                { "key": "package_ecosystems", "type": "array", "required": false, "description": "Unique package ecosystems seen in this event, e.g. [\'PyPI\', \'npm\']. Useful for policy rules that restrict which ecosystems are permitted." },
+                { "key": "package_advisory_count", "type": "number", "required": false, "description": "Total number of non-malicious OSV advisories (GHSA- / CVE- IDs) found across all checked packages. Excludes MAL- entries counted in malicious_package_detected." },
+                { "key": "package_risk_score", "type": "number", "required": false, "description": "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory_count for advisory-only packages; 0 when all packages are clean." },
                 { "key": "package_check_status", "type": "string", "required": false, "description": "Set to \'degraded\' when the osv.dev lookup failed and packages could not be verified (fail-open). Combine with package_install_detected to fail closed" },
                 { "key": "encoded_content_detected", "type": "boolean", "required": false, "description": "Whether encoded content was detected (base64, hex, unicode, URL encoding) that may hide malicious payloads" },
                 { "key": "encoded_types", "type": "array", "required": false, "description": "Array of encoding types detected (e.g., [\'base64\', \'hex\', \'unicode\', \'url\']). Use .contains() to check for specific encoding types" },
@@ -3711,6 +3735,10 @@ export const GUARDRAILS_CONTEXT = {
                 { "key": "malicious_package_detected", "type": "boolean", "required": false, "description": "Whether any referenced package has a known-malicious OSV advisory (OpenSSF MAL- ID). Use to block supply-chain attacks at install time" },
                 { "key": "malicious_package_score", "type": "number", "required": false, "description": "100 when a malicious package was detected, 0 otherwise" },
                 { "key": "malicious_packages", "type": "array", "required": false, "description": "Malicious packages as ecosystem/name[@version] strings (e.g. \'PyPI/evil-pkg@1.0.0\')" },
+                { "key": "package_names", "type": "array", "required": false, "description": "Names of all packages parsed from the install command (without ecosystem prefix), e.g. [\'requests\', \'left-pad\']. Available even when the osv.dev lookup fails." },
+                { "key": "package_ecosystems", "type": "array", "required": false, "description": "Unique package ecosystems seen in this event, e.g. [\'PyPI\', \'npm\']. Useful for policy rules that restrict which ecosystems are permitted." },
+                { "key": "package_advisory_count", "type": "number", "required": false, "description": "Total number of non-malicious OSV advisories (GHSA- / CVE- IDs) found across all checked packages. Excludes MAL- entries counted in malicious_package_detected." },
+                { "key": "package_risk_score", "type": "number", "required": false, "description": "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory_count for advisory-only packages; 0 when all packages are clean." },
                 { "key": "package_check_status", "type": "string", "required": false, "description": "Set to \'degraded\' when the osv.dev lookup failed and packages could not be verified (fail-open). Combine with package_install_detected to fail closed" },
                 { "key": "encoded_content_detected", "type": "boolean", "required": false, "description": "Whether encoded content was detected in tool arguments (base64, hex, unicode encoding hiding payloads)" },
                 { "key": "encoded_types", "type": "array", "required": false, "description": "Array of encoding types detected in tool arguments (e.g., [\'base64\', \'hex\'])" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highflame/policy",
-  "version": "2.2.23",
+  "version": "2.2.24",
   "engines": {
     "node": ">=18"
   },