
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
You're building agent systems that take real actions in the world. Before any agent runs, you need to prove the world is in a safe state. But current approaches are brittle, error-prone, and impossible to audit.
🔥 Boolean Soup: Your pre-condition checks look like this:
if (user.isAuthenticated && !system.maintenanceMode &&
(user.hasRole('admin') || (user.hasRole('user') && !user.isRestricted)) &&
system.healthCheck() && !rateLimit.exceeded) {
// Let agent run
}
🔥 No Audit Trail: When an agent is blocked, you get: "Access denied" - but why?
🔥 Fragile Logic: One wrong && vs || and your agents misbehave in production
🔥 Scattered Conditions: Pre-condition logic is buried across multiple files and functions
🔥 Testing Nightmare: How do you test all combinations of 10+ boolean conditions?
This system enables declarative logical reasoning by:
# Clone/download this repository. Then...
cd <your repo>
yarn install
import { join } from 'node:path';
import { runGentzenReasoning } from '../main.js';
const WD = import.meta.dirname;
console.log('🧪 Minimal example - just the basics...\n');
// Simplest possible usage
const results = await runGentzenReasoning(
join(WD, './scenarios/mixed-scenario.yaml'),
{ resolversPath: join(WD, './resolvers') }
);
console.log(`✅ ${results.summary.provenTargets}/${results.summary.totalTargets} targets proven`);
examples/scenarios/mixed-scenario.yaml):propositions:
- ProcessOrder
- SendAlert
- ScheduleMaintenance
steps:
# Business logic: Customer + Payment.
- rule: alpha
subtype: and
from:
- CustomerIsVIP
- PaymentProcessed
# Combined business decision
- rule: alpha
subtype: implies
from:
- (CustomerIsVIP ∧ PaymentProcessed)
- ProcessOrder
# Provable targets.
targets:
- (CustomerIsVIP ∧ PaymentProcessed)
- ProcessOrder
Resolver Functions (examples/resolvers/factResolvers.js):
export const travelFactResolvers = {
CustomerIsVIP: () => true,
PaymentProcessed: () => true,
SystemHealthy: () => true,
IsBusinessHours: () => false
};
Run Example:
node examples/demo-minimal.js
false → ~FactName).Alpha Rule (AND/IMPLIES):
alpha + subtype: and → Creates conjunction: (A ∧ B)alpha + subtype: implies → Creates implication: (A → B)Beta Rule (OR):
beta → Creates disjunction: (A ∨ B)Contraposition:
contraposition → From (A → B) derives (~B → ~A)Double Negation:
doubleNegation + subtype: introduction → A becomes ~~AdoubleNegation + subtype: elimination → ~~A becomes AEquivalence:
equivalence → Creates biconditional: (A ↔ B)runGentzenReasoning(scenarioPath, options)
Parameters:
scenarioPath (string): Path to YAML scenario fileoptions (object):
verbose (boolean): Enable detailed output.customResolvers (object): Direct resolver functions.resolversPath (string): Path to auto-discover resolvers.validate (boolean): Enable scenario validation.Returns: Results object with targets, summary, availableFacts, etc.
When resolvers return false, the system automatically makes negated facts available:
const resolvers = {
UserLoggedIn: () => true, // Creates: UserLoggedIn
MaintenanceMode: () => false, // Creates: ~MaintenanceMode
SystemOnline: () => false // Creates: ~SystemOnline
};
This enables reasoning with negative conditions:
targets:
- (UserLoggedIn ∧ ~MaintenanceMode) # Provable!
yarn test # All tests
yarn test:unit # Unit tests only
yarn test:integration # Integration tests only
yarn test:verbose # Detailed output
∧ (AND): Both conditions must be true∨ (OR): Either condition can be true→ (IMPLIES): If-then logical implication↔ (EQUIVALENT): If-and-only-if (biconditional)~ (NOT): Negation~~ (DOUBLE NEGATION): Classical logic double negationOperator Aliases: The parser accepts multiple formats for conditionals:
∧, AND, &∨, OR, |→, IMPLIES, ->FAQs
Formal reasoning for agents
We found that gentzen demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.