
Research
5 Malicious Chrome Extensions Enable Session Hijacking in Enterprise HR and ERP Systems
Five coordinated Chrome extensions enable session hijacking and block security controls across enterprise HR and ERP platforms.
@new-ui/agents
Advanced tools
Generate, validate, and manage AI agent policy files for web apps and sites.
npm install @new-ui/agents --save-dev
The package supports multiple configuration methods:
AGENTS_BASE_URL=https://example.com
AGENTS_PROJECT_NAME=my-project
AGENTS_AUTH_URL=https://auth.example.com
AGENTS_TOKEN_URL=https://auth.example.com/token
Create agents.config.js or .agentsrc.json in your project root:
{
"baseUrl": "https://example.com",
"projectName": "my-project",
"environment": "development",
"security": {
"requireAuth": true,
"cors": {
"enabled": true,
"allowedOrigins": ["https://example.com"]
}
}
}
You can override default templates by placing them in .well-known/templates/:
.well-known/
templates/
ai-policy.json
agents.json
semantic-sitemap.json
# ... other templates
# Interactive setup
npm exec agents init --interactive
# Quick setup with defaults
npm exec agents init
agents init [options]
Options:
-d, --dir <path> Output directory (default: ".well-known")
-i, --interactive Enable interactive mode
-e, --environment Target environment (development|staging|production)
--dry-run Preview changes without writing files
agents validate [options]
Options:
-d, --dir <path> Directory containing policy files
-f, --fix Attempt to fix validation issues
agents upgrade [options]
Options:
-d, --dir <path> Directory containing policy files
--dry-run Preview changes without writing files
Create a .agentsrc.json file in your project root:
{
"outputDir": ".well-known",
"templates": {
"directory": "templates",
"customDir": ".agents/templates"
},
"validation": {
"enabled": true,
"strict": false
},
"environments": ["development", "staging", "production"],
"logging": {
"level": "info",
"format": "pretty"
},
"security": {
"checkPolicies": true,
"allowMerge": true
}
}
{
"version": "1.0",
"environment": "development",
"policy": {
"agents": {},
"semantic_sitemap": "/ai-sitemap.json",
"negotiation_api": "/api/ai-negotiate",
"security": {
"maxTokensPerRequest": 4096,
"requireAuthentication": true,
"rateLimiting": {
"enabled": true,
"maxRequests": 100,
"windowMs": 60000
}
}
}
}
{
"version": "1.0",
"agents": []
}
# LLM Access Rules
User-agent: *
Allow: /api/ai-negotiate
Allow: /ai-sitemap.json
Disallow: /private/*
The following files will be generated in your output directory:
ai-policy.json - Main AI policy configuration
agents.json - List of registered AI agents
llms.txt - LLM access rules (robots.txt format)
semantic-sitemap.json - Site structure for AI navigation
security-rules.json - Detailed security configurations
agent-capabilities.json - Standard and custom agent capabilities
{{environment}}: Current environment (development, staging, production){{projectName}}: Name of your project{{version}}: Version of the policy files{{timestamp}}: Current timestamp{{baseUrl}}: Base URL of your site{{authUrl}}: OAuth2 authorization URL{{tokenUrl}}: OAuth2 token URL{{lastUpdated}}: File generation timestamp{{generator}}: Package identifier (@new-ui/agents)FAQs
Generate AI agent policy files for web apps and sites.
We found that @new-ui/agents demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Five coordinated Chrome extensions enable session hijacking and block security controls across enterprise HR and ERP platforms.

Research
Node.js patched a crash bug where AsyncLocalStorage could cause stack overflows to bypass error handlers and terminate production servers.

Research
/Security News
A malicious Chrome extension steals newly created MEXC API keys, exfiltrates them to Telegram, and enables full account takeover with trading and withdrawal rights.