
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
TrigGuard public SDK — authorize, verify, receipts, agents, CLI. One install.
trigguard — canonical product SDKExecution authorization for AI agents and automated systems.
npm install trigguard
import {
authorize,
verify,
receipt,
explain,
createAgent,
createClient,
} from "trigguard";
CLI is the same install:
npx trigguard authorize
npx trigguard verify
npx trigguard policy
npx trigguard demo
| Install | Role |
|---|---|
npm install trigguard | SDK + CLI |
pip install trigguard | Python SDK |
pip install authgraph | Execution intelligence |
npx @trigguard/mcp | MCP |
pip install trigguard-litellm | LiteLLM callback |
Internals (@trigguard/execution-sdk, agent-sdk, intent-sdk, …) stay in the monorepo. Prefer this package. Subpaths exist for gradual migration: trigguard/execution, trigguard/agent, trigguard/express, trigguard/proxy.
Offline demo: examples/quickstart-node/.
| Method | Purpose |
|---|---|
authorize | POST /v1/authorize — returns CustomerDecisionResult |
verify | Offline receipt signature verification |
explain | Human-readable decision summary |
attest | Record an attestation via authorize |
audit | Query workspace audit entries |
coach | Advisory outcome preview (non-binding) |
Integration helpers:
@trigguard/execution-sdk — shared HTTP client (prefer trigguard for apps)@trigguard/agent-sdk — npm install @trigguard/agent-sdk for agents@trigguard/proxy / @trigguard/express-middleware — Express; not included in the flagship installArchitecture freeze: docs/PACKAGE_ARCHITECTURE.md.
Policy simulation (advisory, separate install):
npm install @trigguard/simulator
| Legacy | Status | Use instead |
|---|---|---|
@trigguard/execution-sdk | Supported, deprecated | npm install trigguard |
sdk/node (@trigguard/decision) | Supported, deprecated (Rail B) | createTrigGuard().authorize() |
trigguard-js | Legacy | createTrigGuard() |
Guide: docs/adoption/MIGRATE_TO_TRIGGUARD_SDK.md.
HOLD until verb parity with Node — see output/PYTHON_PUBLISH_HOLD.md.
Development: pip install -e sdk/python · examples/quickstart-python/
npm run build -w trigguard
npm run test -w trigguard
See docs/adoption/FIRST_10_MINUTES.md for onboarding.
FAQs
TrigGuard public SDK — authorize, verify, receipts, agents, CLI. One install.
We found that trigguard demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.