
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@torknetwork/sdk
Advanced tools
Tork Governance SDK - PII detection, policy enforcement, and AI agent governance for JavaScript/TypeScript
Official JavaScript/TypeScript SDK for Tork Governance - AI agent governance, PII detection, and policy enforcement.
npm install @torknetwork/sdk
import { PIIRedactor } from '@torknetwork/sdk';
const redactor = new PIIRedactor();
// Detect PII
const matches = redactor.detect('Email: john@example.com, SSN: 123-45-6789');
console.log(matches);
// [
// { type: 'EMAIL', value: 'john@example.com', start: 7, end: 23, confidence: 0.95 },
// { type: 'SSN', value: '123-45-6789', start: 30, end: 41, confidence: 0.95 }
// ]
// Redact PII
const result = redactor.redact('My email is john@example.com');
console.log(result.redacted);
// 'My email is [EMAIL]'
import { GovernanceEngine } from '@torknetwork/sdk';
const engine = new GovernanceEngine();
const result = engine.evaluate({
agentId: 'my-agent',
payload: { message: 'User SSN is 123-45-6789' }
});
console.log(result.decision); // 'block'
console.log(result.score); // 25
console.log(result.piiMatches); // [{ type: 'SSN', ... }]
console.log(result.receipt.id); // 'tork_xxx_yyy'
import { TorkClient } from '@torknetwork/sdk';
const client = new TorkClient({
apiKey: 'your-api-key'
});
// Evaluate via API
const result = await client.evaluate({
agentId: 'my-agent',
payload: { message: 'Hello world' }
});
// Get agent score
const score = await client.getScore('my-agent');
import express from 'express';
import { torkMiddleware } from '@torknetwork/sdk/express';
const app = express();
app.use(express.json());
// Add governance middleware
app.use('/api', torkMiddleware({
agentId: 'my-api',
mode: 'enforce',
localMode: true,
excludePaths: ['/health']
}));
app.post('/api/chat', (req, res) => {
// req.body is automatically redacted if PII was found
// req.tork contains the governance result
res.json({ received: req.body });
});
| Type | Example |
|---|---|
EMAIL | john@example.com |
PHONE | (555) 123-4567 |
SSN | 123-45-6789 |
CREDIT_CARD | 4532-0151-1283-0366 |
IP_ADDRESS | 192.168.1.1 |
AWS_ACCESS_KEY | AKIAIOSFODNN7EXAMPLE |
AWS_SECRET_KEY | wJalrXUtnFEMI/K7MDENG... |
GITHUB_TOKEN | ghp_xxxxxxxxxxxx |
STRIPE_KEY | sk_live_xxxxx |
JWT_TOKEN | eyJhbGciOiJ... |
IBAN | DE89370400440532013000 |
PASSPORT | A12345678 |
PRIVATE_KEY | -----BEGIN PRIVATE KEY----- |
| And more... |
allow - Request is safeblock - Request contains high-risk contentredact - PII detected and redactedreview - Flagged for human reviewEach PII type has a risk weight (0-35). Scores are calculated based on:
| Risk Level | Score Range |
|---|---|
| Low | 0-20 |
| Medium | 20-50 |
| High | 50-80 |
| Critical | 80-100 |
const redactor = new PIIRedactor({
types: ['EMAIL', 'SSN'], // Filter PII types
minConfidence: 0.8, // Minimum confidence threshold
replacement: '[REDACTED]', // Custom replacement text
});
redactor.detect(text: string): PIIMatch[]
redactor.redact(text: string): RedactionResult
redactor.containsPII(text: string): boolean
redactor.getSummary(text: string): Record<PIIType, number>
const engine = new GovernanceEngine({
policies: [...], // Custom policy rules
piiTypes: ['EMAIL', 'SSN'], // PII types to scan
thresholds: {
block: 80,
review: 50,
redact: 20,
},
});
engine.evaluate(request): EvaluationResult
engine.addPolicy(policy): void
engine.removePolicy(policyId): boolean
engine.getPolicies(): PolicyRule[]
const client = new TorkClient({
apiKey: 'xxx',
baseUrl: 'https://api.tork.network',
timeout: 30000,
retries: 3,
});
await client.evaluate({ agentId, payload }): EvaluateResponse
await client.redact(text): RedactResponse
await client.getScore(agentId): ScoreResponse
await client.getAuditLogs(agentId, options): AuditLogsResponse
import { torkMiddleware, piiRedactionMiddleware } from '@torknetwork/sdk/express';
// Full governance
app.use(torkMiddleware({
agentId: 'my-api',
mode: 'enforce', // 'enforce' | 'warn' | 'audit'
localMode: true, // Use local engine (no API calls)
apiKey: 'xxx', // Required if localMode: false
excludePaths: ['/health'],
onDecision: (result, req, res) => { ... },
}));
// PII redaction only
app.use(piiRedactionMiddleware({
agentId: 'my-api',
}));
const engine = new GovernanceEngine({
policies: [
{
id: 'block-secrets',
name: 'Block Secrets',
condition: {
piiTypes: ['AWS_SECRET_KEY', 'PRIVATE_KEY'],
},
action: 'block',
priority: 100,
},
{
id: 'review-keywords',
name: 'Review Sensitive Keywords',
condition: {
keywords: ['confidential', 'internal only'],
riskScoreThreshold: 30,
},
action: 'review',
priority: 50,
},
{
id: 'custom-check',
name: 'Custom Check',
condition: {
custom: (request, piiMatches) => {
return request.context?.userId === 'admin';
},
},
action: 'allow',
priority: 200,
},
],
});
MIT - see LICENSE
FAQs
Tork Governance SDK - PII detection, policy enforcement, and AI agent governance for JavaScript/TypeScript
The npm package @torknetwork/sdk receives a total of 13 weekly downloads. As such, @torknetwork/sdk popularity was classified as not popular.
We found that @torknetwork/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.