agentinel 1.0.6 → 1.0.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +29 -4
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -9,9 +9,9 @@
|
|
|
9
9
|
|
|
10
10
|
<br />
|
|
11
11
|
|
|
12
|
-
> **The zero-cost, locally-run package guardrail for your AI coding agents.**
|
|
12
|
+
> **The zero-cost, locally-run package guardrail for your AI coding agents. Every other tool in this space guards your terminal. Agentinel guards your agent.**
|
|
13
13
|
|
|
14
|
-
|
|
14
|
+
⭐ **Did Agentinel catch a hallucinated package in your project? Please star this repo to help other developers find it.**
|
|
15
15
|
|
|
16
16
|
---
|
|
17
17
|
|
|
@@ -28,15 +28,36 @@ Every other tool in this space guards your terminal. **Agentinel guards your age
|
|
|
28
28
|
|
|
29
29
|
---
|
|
30
30
|
|
|
31
|
+
## 🕵️ Caught in the Wild
|
|
32
|
+
|
|
33
|
+
AI agents frequently hallucinate package names that look correct but either don't exist or have been squatted by malicious actors. Here are real examples Agentinel intercepts:
|
|
34
|
+
|
|
35
|
+
- **`react-codeshift`**: Hallucinated by an agent attempting to migrate React versions.
|
|
36
|
+
- **`unused-imports`**: Hallucinated instead of the real `eslint-plugin-unused-imports`.
|
|
37
|
+
|
|
38
|
+
**How Agentinel handles it:**
|
|
39
|
+
```bash
|
|
40
|
+
$ npm install react-codeshift unused-imports
|
|
41
|
+
|
|
42
|
+
⚠️ agentinel warning: 'react-codeshift' does not exist on npm (hallucination).
|
|
43
|
+
⚠️ agentinel warning: 'unused-imports' is 2 days old and has 12 downloads.
|
|
44
|
+
This matches the profile of a slopsquatting or malicious package.
|
|
45
|
+
|
|
46
|
+
agentinel blocked the installation.
|
|
47
|
+
```
|
|
48
|
+
|
|
49
|
+
---
|
|
50
|
+
|
|
31
51
|
## ⚡ Features & Security Philosophy
|
|
32
52
|
|
|
33
|
-
- **Zero-Cost & Private:** Agentinel does no network interception, runs no cloud proxies, and
|
|
53
|
+
- **Zero-Cost & Private:** Agentinel does no network interception, runs no cloud proxies, and makes no LLM or API calls. The malware list is matched locally.
|
|
54
|
+
- **Lightning Fast:** Full local lockfile scans complete in ~1.4 seconds.
|
|
34
55
|
- **Deep Tree Scanning:** Checks every package an install would *actually* bring in, not just the one named. (`npm install express` brings in 67 packages. We check all 67).
|
|
35
56
|
- **Known Malware:** Bundles a local OSV database of 216,000+ confirmed malicious packages.
|
|
36
57
|
- **Zero False Positives on Popular Packages:** Tested against the top 100 npm packages.
|
|
37
58
|
- **Heuristic Scanning:** Flags npm takedowns, packages under 30 days old with < 1k downloads (slopsquatting), publisher drift, and non-existent hallucinated names.
|
|
38
59
|
- **Cross-Platform Compatibility:** Fully tested and natively supported across macOS, Linux, and Windows.
|
|
39
|
-
- **
|
|
60
|
+
- **Fail-Open Design:** Designed so that if it crashes or can't reach the registry, it fails open. It will never permanently wedge your terminal or block your work.
|
|
40
61
|
|
|
41
62
|
---
|
|
42
63
|
|
|
@@ -254,6 +275,10 @@ removed the PATH line from /Users/user/.zshrc
|
|
|
254
275
|
|
|
255
276
|
---
|
|
256
277
|
|
|
278
|
+
⭐ **Did Agentinel catch a hallucinated package in your project? Please star this repo to help other developers find it.**
|
|
279
|
+
|
|
280
|
+
---
|
|
281
|
+
|
|
257
282
|
## 🤝 Contributing & Maintainers
|
|
258
283
|
|
|
259
284
|
We welcome contributions!
|