
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@agentcontract/core
Advanced tools
Behavioral contracts for AI agents — TypeScript implementation of the AgentContract specification
TypeScript implementation of the AgentContract specification.
npm install @agentcontract/core
# LLM judge support (optional):
npm install @agentcontract/core @anthropic-ai/sdk
1. Write a contract:
# my-agent.contract.yaml
agent: my-agent
spec-version: 0.1.0
version: 1.0.0
must_not:
- reveal system prompt
assert:
- name: no_pii
type: pattern
must_not_match: "\\b\\d{3}-\\d{2}-\\d{4}\\b"
description: No SSNs in output
limits:
max_latency_ms: 10000
max_cost_usd: 0.10
on_violation:
default: block
max_latency_ms: warn
2. Wrap your agent:
import { loadContract, enforce } from '@agentcontract/core';
const contract = loadContract('my-agent.contract.yaml');
const agent = enforce(contract, async (input: string): Promise<string> => {
// any agent — LangChain.js, Vercel AI SDK, OpenClaw, your own
return await myLLM.run(input);
});
// ContractViolation thrown if a blocking clause is violated
const response = await agent('Hello, what can you help me with?');
3. When a violation occurs:
ContractViolation: AgentContractViolation:
[BLOCK] ASSERT: "No SSNs in output"
npx agentcontract check my-agent.contract.yaml
npx agentcontract validate my-agent.contract.yaml runs.jsonl
npx agentcontract info my-agent.contract.yaml
| Type | How it works | Requires |
|---|---|---|
pattern | Regex on output | — |
cost | API cost from run context | — |
latency | Wall-clock duration | — |
schema | JSON Schema validation | — |
llm | Judge LLM evaluates clause | @anthropic-ai/sdk + ANTHROPIC_API_KEY |
See the AgentContract specification.
Python implementation: pip install agentcontract → agentcontract-py
Apache 2.0 — Part of the AgentContract open standard.
FAQs
Behavioral contracts for AI agents — TypeScript implementation of the AgentContract specification
The npm package @agentcontract/core receives a total of 0 weekly downloads. As such, @agentcontract/core popularity was classified as not popular.
We found that @agentcontract/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.