
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@evalguard/wrapper-core
Advanced tools
Shared core for EvalGuard provider SDK wrappers — GuardrailClient, cost table, BYOK, retry + circuit-breaker, idempotency, eval-on-response.
Shared core for EvalGuard provider SDK wrappers. Not typically used directly — install one of the provider wrappers instead:
| Module | Exports |
|---|---|
guardrail-client | GuardrailClient — HTTP client for firewall-check / trace-log / score-output, all fail-open |
cost | estimateCost(model, inputTokens, outputTokens) — pricing table for 30+ models across OpenAI / Anthropic / Gemini |
trace-id | newTraceId(), injectTraceHeader(), isValidTraceId() — per-request UUID for log correlation |
byok | resolveApiKey() — supports string | () => string | Promise<string> |
idempotency | resolveIdempotencyKey() — auto-generated, literal, or function-supplied |
retry | withRetry() — exponential backoff + per-base-URL circuit breaker |
eval-on-response | runPostResponseEval() — post-completion output scoring |
types | EvalGuardConfig, EvalGuardViolationError, EvalGuardOutputViolationError, etc. |
The v1.0 wrappers (evalguardai-openai, evalguardai-anthropic) each shipped
inline copies of GuardrailClient and cost.ts. That worked for two
providers but didn't scale — adding Gemini meant a third copy, and adding
features (BYOK, idempotency, retry+circuit-breaker, eval-on-response) meant
3× the surface area to keep in sync.
This package consolidates the shared foundation. Wrappers import from it via workspace dep during development and npm dep once published.
MIT
FAQs
Shared core for EvalGuard provider SDK wrappers — GuardrailClient, cost table, BYOK, retry + circuit-breaker, idempotency, eval-on-response.
The npm package @evalguard/wrapper-core receives a total of 24 weekly downloads. As such, @evalguard/wrapper-core popularity was classified as not popular.
We found that @evalguard/wrapper-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.