
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
SED (Semantic Entity Design) - Connect AI to Your Database with Easy Integration
SED automatically converts your raw database into an AI-ready semantic layer with intelligent business rules.
SED creates a semantic layer that makes AI understand your business data instantly, with automatic business rule generation for security and compliance.
SED is a local-first database intelligence layer that bridges the gap between technical database schemas and business understanding. It automatically discovers your database structure, generates semantic mappings, and enforces business rules for AI applications.
SED analyzes your database schema and creates business-friendly semantic mappings:
{
"entities": [
{
"name": "Customer",
"description": "A person who can place orders and has an account",
"databaseTable": "users",
"attributes": [
{
"name": "email",
"description": "Email address",
"databaseColumn": "email"
}
]
}
]
}
SED automatically generates and enforces business rules:
npm install -g sed-cli
npx sedql init
This interactive command will:
Supported Databases:
npx sedql query "show me customer orders from last month"
Use natural language to query your database. SED automatically:
# List all rules
npx sedql rules --list
# Disable a rule temporarily
npx sedql rules --disable pii-protection
# Add custom rules
npx sedql rules --add custom-rules.json
sedql init - Initialize SED with database connection and setup everythingsedql build - Rebuild semantic layer and business rulessedql query <query> - Query database using natural languagesedql validate - Validate semantic layer and business rulessedql status - Show current SED status and configurationsedql rules --list - List all business rulessedql rules --add <file> - Add custom rules from JSON filesedql rules --disable <rule-id> - Disable a specific rulesedql rules --enable <rule-id> - Enable a specific rulesedql export - Export semantic layer and configurationsedql import <file> - Import configuration from fileSED_ANALYTICS=trueSED automatically creates business rules based on your database:
{
"id": "pii-protection",
"name": "PII Protection",
"type": "access_policy",
"severity": "block",
"condition": {
"type": "pattern",
"pattern": ".*(ssn|password|email).*"
},
"action": {
"type": "deny",
"message": "Access to PII columns is not allowed"
}
}
# See what rules exist
sedql rules --list
# Filter rules by type
sedql rules --list --type access_policy
# Add custom business hours rule
sedql rules --add business-hours.json
# Disable PII protection temporarily
sedql rules --disable pii-protection
We welcome contributions! Please see our Contributing Guidelines for details.
git clone https://github.com/holy182/sed-cli.git
cd sed-cli
npm install
npm run build
npm test
npm test
npm run test:security
GNU Affero General Public License v3.0 (AGPL-3.0) - see LICENSE file for details.
Important: This software is licensed under the AGPL-3.0 license. If you modify and distribute this software, you must make your source code available under the same license. This ensures that improvements to SED's security and governance capabilities are shared back with the community.
FAQs
SED (Semantic Entity Design) - Connect AI to Your Database with Easy Integration
We found that sed-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.