llm-trust-guard 4.21.2 → 4.21.3

package/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to `llm-trust-guard` will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.21.3] - 2026-06-13
+
+### Docs / CI
+
+- **README**: the `CodeAnalyzerBackend` example is now complete and copy-pasteable
+  (full acorn walker that blocks `constructor.constructor` / `Function` gadgets), with
+  a GitHub link to the full reference. It previously called a placeholder function and
+  pointed at `examples/…` which isn't shipped in the npm package — so consumers had no
+  runnable backend for the headline new feature.
+- **CI**: bumped GitHub Actions off the deprecated Node 20 runtime (`checkout@v6`,
+  `setup-node@v6`, `setup-python@v6`, `gh-release@v3`, `github-script@v8`) ahead of the
+  2026-06-16 forced migration.
+
+No code/behavior change.
+
 ## [4.21.2] - 2026-06-12
 
 ### Docs — document `CodeAnalyzerBackend`; add README-sync gate (G11)

package/README.md

@@ -201,20 +201,46 @@ or the `Function` constructor, plug in a parser via `analyzerBackend` (findings
 additive; a throwing backend never crashes the guard):
 
 ```ts
-import { CodeExecutionGuard, type CodeAnalyzerBackend } from 'llm-trust-guard';
+import { CodeExecutionGuard, type CodeAnalyzerBackend, type CodeFinding } from 'llm-trust-guard';
 import { parse } from 'acorn'; // your dependency, not the library's
 
+function walk(node: any, visit: (n: any) => void) {
+  if (!node || typeof node !== 'object') return;
+  if (typeof node.type === 'string') visit(node);
+  for (const k of Object.keys(node)) {
+    const c = node[k];
+    if (Array.isArray(c)) c.forEach((x) => walk(x, visit));
+    else if (c && typeof c === 'object') walk(c, visit);
+  }
+}
+
 const acornBackend: CodeAnalyzerBackend = (code, language) => {
   if (language !== 'javascript') return [];
-  // walk the AST, return [{ name, severity }] for dangerous nodes
-  return findGadgets(parse(code, { ecmaVersion: 'latest', sourceType: 'module' }));
+  let ast: any;
+  try { ast = parse(code, { ecmaVersion: 'latest', sourceType: 'module' }); }
+  catch { return []; } // unparseable — the guard's regex pass still ran
+  const findings: CodeFinding[] = [];
+  walk(ast, (n) => {
+    // X.constructor.constructor(...) — classic sandbox escape
+    if (n.type === 'CallExpression' && n.callee?.property?.name === 'constructor' &&
+        n.callee.object?.property?.name === 'constructor') {
+      findings.push({ name: 'constructor_escape', severity: 60 });
+    }
+    // Function('...') as a call (no `new`)
+    if (n.type === 'CallExpression' && n.callee?.type === 'Identifier' && n.callee.name === 'Function') {
+      findings.push({ name: 'function_constructor', severity: 50 });
+    }
+  });
+  return findings;
 };
 
 const guard = new CodeExecutionGuard({ analyzerBackend: acornBackend });
+guard.analyze("this.constructor.constructor('return process')()", 'javascript').allowed; // false
 ```
 
-See `examples/acorn-code-analyzer.ts` for a complete reference. The Python package
-ships this analysis built in (stdlib `ast`, no backend needed).
+Full reference (also handles `__proto__` and dynamic `import()`):
+[`examples/acorn-code-analyzer.ts`](https://github.com/nkratk/llm-trust-guard/blob/main/examples/acorn-code-analyzer.ts).
+The Python package ships this analysis built in (stdlib `ast`, no backend needed).
 
 ## OWASP Coverage
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llm-trust-guard",
-  "version": "4.21.2",
+  "version": "4.21.3",
   "description": "Comprehensive security guards for LLM-powered and agentic AI applications - 34 guards covering OWASP Top 10 for LLMs 2025, Agentic Applications 2026, and MCP Security. All guards accessible via unified TrustGuard facade. Features prompt injection (PAP/persuasion), multi-modal attacks, RAG poisoning with embedding attack detection, memory persistence attacks, code execution sandboxing, multi-agent security (spawn policy, delegation scope, trust transitivity), MCP tool shadowing prevention, system prompt leakage protection, human-agent trust exploitation (ASI09), autonomy escalation (ASI10), state persistence (ASI08), tool chain validation v2 (ASI07/ASI04), circuit breaker, drift detection, and more",
   "main": "dist/index.js",
   "module": "dist/index.mjs",