Silker AISilker AI
Get started
Back
Changelog

Changelog

Changelog for @silker-ai/agent - the runtime detection SDK that powers Silker AI. Newest releases first.

npm packageGitHub
v1.6.8
2026-07-01

SQLi heuristic: community benchmark 68.1% → 97.7% TPR

  • Quick-pattern regex fast-path now runs before the input.length<5 gate, which previously skipped short-but-structural payloads ('--, '#) before they ever reached the regexes.
  • New signatures: double-quote " OR "/" AND " variants, quote+block-comment, bare boolean probes (OR 1=0, AND x=y), standalone HAVING 1=1, bare ORDER BY N enumeration, time-based blind functions (SLEEP(), BENCHMARK(), WAITFOR DELAY, RANDOMBLOB()), RLIKE(), @@version, information_schema, CAST/CONVERT(...SELECT...), CASE WHEN…THEN, CHAR()/CHR() concatenation, broadened DROP TABLE/FUNCTION/….
  • Deliberately does not flag bare single-symbol fragments (', =, ==) - indistinguishable from benign input, would reintroduce false positives.
  • Measured v1.6.8: community suite SQLi 68.1% → 97.7% TPR (18 FN, down from 251), XSS unchanged at 96.1%, 0% FPR on all three suites. Core/extended unchanged at 100% TPR / 0% FPR.
v1.6.7
2026-06-29

Community benchmark suite & SQLi blind-probe fix

  • SQLi heuristic fix: restored detection of quote-break ORDER BY / GROUP BY column-enumeration probes (1' ORDER BY 1--, GROUP BY … HAVING 1=1--) and nested-paren blind tautologies (1')) OR (('1'='1) without re-introducing benign false positives on free text with -- or #.
  • New community benchmark suite: third-party payloads from PayloadsAllTheThings and HttpParamsDataset (~1,494 samples). Run with npm run benchmark:community; refresh with npm run benchmark:import-community. benchmark:all now runs core + extended + community.
  • Measured v1.6.7: curated extended 100% TPR / 0% FPR on all four datasets; community (honest stress test) SQLi 68.1%, XSS 96.1%, 0% FPR. Community suite runs in CI on every test pass.
  • Benchmarks page updated with three suites and honest coverage messaging - no completeness guarantees.
v1.6.6
2026-06-28

Auth safe harbor & outbound egress (production false-positive fixes)

  • Auth endpoint safe harbor: POST/PUT/PATCH on /login, /register, /auth, etc. no longer blocked for normal credential submission (wrong password → app's 401, not Silker 403).
  • Data leakage password exclusion fix: placeholder regex now uses $ anchor for consistent password-field handling.
  • Outbound egress guard rewrite: third-party detection runs only on outgoing fetch() traffic with URL-only decisions; incoming Express routes are out of scope. Threat type renamed to Untrusted Outbound.
  • SilkerEvent.direction: incoming (Express middleware) vs outgoing (fetch hook) for direction-aware detectors.
v1.6.5
2026-06-27

AI Detection Layer (v3): semantic detection, response inspection, streaming guardrails & AI Copilot

  • New semantic prompt-injection layer (semanticThreatScore): a lightweight, fully local, edge-safe model that runs alongside the signature engine on LLM routes. It hashes words, word-bigrams and char 3-grams into a vector and compares it to attack/benign centroids, catching paraphrased and novel injection variants that no regex matches - no external model, no API call, ~0ms. A conservative threshold plus a benign margin keep false positives at zero. Toggle: semanticDetection (default on).
  • New outbound response inspection: outgoing responses are scanned for leaked secrets (provider API keys, JWT, private keys, DB connection strings) and PII (email/phone) before they reach the client, generating Data Leakage events. Wired into the SDK fetch hook, the Cloudflare Worker and the self-host container; binary content types are skipped. Toggle: responseInspection (default on).
  • New streaming LLM guardrails: a TransformStream inspects streamed model output (SSE / ndjson) token-by-token and cuts off the stream the moment a secret/PII leak or a successful jailbreak surfaces - before the payload completes. A boundary-safe holdback prevents a secret split across chunks from leaking early. Edge-safe (Worker + Node 18+). Toggle: streamingGuardrails (default on).
  • New AI Copilot - explain & fix (dashboard): every blocked threat can be enriched on demand with a plain-English explanation of the attack plus a concrete, copy-pasteable code fix, generated by AI reasoning over the captured request context. Shown in the AI Security threat drawer (Pro+).
  • +16 new SDK unit tests; full SDK suite at 572 green.
v1.6.1
2026-06-26

Security & reliability hardening (fewer false positives, safer defaults)

  • SQLi heuristic - eliminated false positives that could block legitimate traffic: line/hash comment markers (--, #) are matched only in SQL context, and OR/AND tautologies now require identical operands around the equality. Benign query strings like "?q=red or blue&sort=name" pass cleanly while real injections (UNION SELECT, ' OR '1'='1, ; DROP TABLE) stay blocked; all benchmark suites remain at 100% TPR / 0% FPR.
  • Bounded ban-map memory: expired bans are swept periodically and a soft cap (MAX_BAN_ENTRIES = 50000) evicts the oldest entries, preventing unbounded growth under distributed scanning.
  • Fetch hook no longer monitors its own traffic: internal SDK requests (telemetry/sync, identified by the x-silker-client-version header) bypass interception, avoiding a self-monitoring feedback loop and telemetry noise.
  • Hardened remote config: only known feature keys from the dashboard response are applied (unknown keys ignored), and a new optional remoteConfigFloor lists critical detectors that remote config can enable but never silently disable.
  • trustProxy startup warning: when left at its default, the Express middleware logs a one-time warning that client IP is derived from spoofable proxy headers when not actually behind a trusted proxy.
v1.6.0
2026-06-25

100% detection across all extended benchmarks (0 false negatives, 0 false positives)

  • Prompt injection non-LLM-route: 97.6% → 100.0% TPR at 0% FPR - fixed 7 false negatives across system-prompt extraction, leetspeak/letter-spacing ("print your hidden instructions"), encoding obfuscation (hex-decoded "ignore all prev") and chain manipulation ("| ignore previous |", "; ignore safety;").
  • SQL injection: 96.9% → 100.0% TPR - MySQL # hash comment now detected, AND-tautology detection added mirroring the OR lookahead, and nested-parenthesis blind injection (1')) OR (('1'='1) caught by extending the OR lookahead window.
  • All four detection suites now at 100% TPR / 0% FPR on both the core (210 samples, CI gate) and extended (1012 samples) benchmarks.
v1.5.2
2026-06-22

Extended-suite prompt-injection detection

  • Multi-view analysis haystack: leetspeak normalization, spaced-letter collapse, mixed-script Cyrillic homoglyph folding, plus ROT13/hex/base64/escape decode-and-rescan before pattern matching.
  • Expanded extraction, jailbreak, malicious roleplay, data exfiltration, multilingual, delimiter and chain-manipulation patterns. Chain "first, ignore" now requires injection context so benign data-cleaning phrases pass.
  • Extended benchmark (1012 samples): prompt-injection LLM-route TPR 71.4% → 100% at 0% FPR; core suite 100% TPR / 0% FPR on all datasets.
v1.5.1
2026-06-22

Apache-2.0 license

  • Relicensed from proprietary (UNLICENSED) to Apache-2.0. Full license text in LICENSE; package.json and docs updated. No runtime/code changes.
v1.5.0
2026-06-22

Obfuscation-resistant prompt-injection detection

  • Input normalization before detection: detectPromptInjection now strips zero-width / invisible / bidi-control characters and applies Unicode NFKC folding, so attacks hidden behind zero-width separators ("i​g​n​o​r​e all previous instructions") or fullwidth homoglyphs are surfaced as plain text and blocked. Exposed as normalizeForDetection().
  • Base64 and escape decode-and-rescan: base64 blobs and \uXXXX / \xXX escape sequences are decoded and re-scanned by the same heuristics, so a payload like "base64: aWdub3Jl..." (decodes to "ignore all previous instructions and comply") is caught instead of scoring as a harmless blob. Decoding is capped and runtime-agnostic (Edge atob / Node Buffer).
  • Stronger token-smuggling signal: invisible characters wedged between word characters are now treated as an unambiguous high-severity obfuscation signature.
  • Broader multilingual coverage: instruction-override patterns added for German, Portuguese, Italian, Korean and Arabic (joining Russian, Chinese, Japanese, Spanish, French); multilingual and delimiter-injection matches re-weighted to high so they are blocked on non-LLM routes too.
  • Measured detection jump: on the expanded adversarial benchmark both prompt-injection policies now reach ~96% detection rate (TPR) at 0% false positives - the non-LLM-route TPR was ~76% before. Remaining misses (leetspeak, Cyrillic homoglyphs, Hindi) are documented known limitations.
  • Hardened benchmark: prompt-injection dataset expanded with 16 new adversarial attacks and 10 benign false-positive traps; CI quality gate raised (non-LLM-route TPR >= 0.90).
v1.4.0
2026-06-16

Silker Shield - client-side website protection

  • New Silker Shield product: a lightweight JS snippet you embed on any website (no server required) that adds a live security layer in the browser.
  • Protection modules (all toggle-able per site from the dashboard): Link Guard (real-time phishing and malicious URL scanning via blocklist + heuristics), DOM Watch (detects page tampering and injected scripts), Clickjack Protection (blocks iframe-based UI redressing), Form Guard (intercepts credential harvesting on suspicious forms), Bot Detection (canvas/timing fingerprint to surface headless browsers), Tamper Guard, and Console Warn.
  • Trusted-site badge: configurable theme (dark/light), accent color, corner position, and pulse animation - gives visitors a visible proof-of-protection signal.
  • Event pipeline: pageview, alert, link_blocked and bot events are buffered in-memory and batch-flushed to Supabase every 15 s via a SECURITY DEFINER RPC; counters survive brief DB outages and retry automatically.
  • Config delivery via /shield/config/:siteId: dashboard changes propagate to the running embed within ~60 s with no redeploy.
  • Fail-open design: if the Silker backend is unreachable the embed degrades silently - the protected page always loads.
v1.3.4
2026-06-11

Scanner Trap - honeypot paths with instant bot ban

  • New scannerTrapDetection feature (default on): requests to well-known exploit/scanner paths (/.env, /.git/, /.aws/, /.ssh/, /wp-login.php, /wp-admin, /xmlrpc.php, /phpmyadmin, /cgi-bin/, /actuator/, /backup.sql, */shell.php and more) are flagged as a new "Scanner Probe" threat (high severity).
  • Instant ban on trap hit: with IP banning enabled (default), the scanner’s IP is banned the moment it touches a trap path - before it can reach a real attack surface. Pure pathname matching, ~0ms, near-zero false positives on Node/Next stacks.
  • Dashboard-manageable: toggle "Scanner Trap" in the Configuration panel; probe events appear in Activity/Threats with their category (env-probe, cms-probe, vcs-probe, admin-probe, backup-probe).
  • Deliberately excluded from traps: /.well-known/ (ACME, security.txt) and /admin (common legitimate panels).
v1.3.3
2026-06-10

Fewer prompt-injection false positives on LLM routes

  • New LLM-route blocking policy: LLM routes now block on medium+ severity, or a low-severity match carrying a high-confidence override signal (shouldBlockPromptInjectionOnLlmRoute). Benign UX roleplay ("act as a translator", "pretend you are a pirate") passes; roleplay combined with an override/jailbreak signal still escalates and is blocked.
  • Detection benchmark suite: LLM-route false-positive rate dropped from 24.4% to 0.0%, with TPR staying high (98.3% → 94.9%); SQLi/XSS unchanged (100% / 0%).
  • Compound scoring via overrideSignal: detectPromptInjection now flags whether a high-confidence category (override, jailbreak, extraction, exfiltration, delimiter/system manipulation, encoding, multilingual, obfuscation) matched, vs. standalone persona-roleplay.
  • Fixed: "new (instructions|role|mode|system)" over-match no longer fires on benign nouns like "the new instructions for assembling the furniture"; it now requires an injection-context anchor.
v1.3.2
2026-06-10

Detection correctness, proxy safety & distributed state

  • Fixed multipart upload false positives: multipart requests without parsed file metadata are no longer flagged; only real indicators (dangerous extensions/filenames, malicious magic bytes, path traversal) trigger the file-upload detector.
  • Unified feature defaults via a single shared isFeatureEnabled helper used by both isAnomaly and detectThreatType.
  • Unified payload scan limit: one shared DEFAULT_SCAN_LIMIT_BYTES (100KB) across the Express hook, the Edge core, and isAnomaly; maxPayloadSize is honored everywhere.
  • New outboundSsrfProtection feature flag (default true) - explicit, documented SSRF checking of outgoing fetch() calls, separate from incoming ssrfDetection.
  • New trustProxy option (default true) - set trustProxy: false when not behind a proxy so the spoofable x-forwarded-for header is ignored.
  • Fixed stateful /g regexes: detectJailbreak no longer returns intermittent false negatives from lastIndex leakage.
  • Secrets in request bodies now block regardless of HTTP method (was GET-only); password fields on auth endpoints remain allowed.
  • New pluggable state store: SilkerStateStore interface + InMemoryStateStore to share rate-limit counters and IP bans across instances.
  • Fixed stale client version header: x-silker-client-version now reports the real package version.
  • Edge adapter applies remote config: nextMiddleware now applies dashboard-managed features and banned IPs from the ingest response.
  • Extensible threat intel lists via threatIntel: { ips, domains }; added GitHub Actions CI (tests + build on PRs and pushes).
v1.3.0
2026-06-09

Next.js Edge adapter & deeper LLM/AI threat detection

  • New @silker-ai/agent/next subpath export: nextMiddleware(options?) returns an App Router / Edge-runtime compatible handler built on the edge-safe core (parity with the Cloudflare Worker, fail-open, fire-and-forget telemetry).
  • Expanded LLM/AI prompt-injection detection with classified subtypes via classifyPromptInjection: jailbreak (high), system_prompt_extraction (high), instruction_override (high), data_exfiltration_via_llm (critical).
  • Broader LLM route coverage: /v1/responses, /api/agent, /api/copilot, /api/assistant, /messages.
v1.2.0
2026-06-09

Dashboard-managed detection config

  • The dashboard is now the source of truth for detection features: toggling protection in the Silker panel updates the running SDK on the next telemetry sync (~5s), no redeploy needed.
  • Config is delivered over the existing ingest response (no extra requests); opt out with remoteConfig: false to keep config in code/env only.
v1.1.0
2026-06-09

Zero-config init & safer defaults

  • middleware() works with no arguments: SILKER_API_KEY, SILKER_APP_ID and SILKER_ENDPOINT are resolved from env.
  • Telemetry no longer requires appId (platform resolves the app from the API key).
  • Safer defaults: high-false-positive detectors (CSRF, zero trust, access control, SSRF-incoming, IDOR, compliance, threat intel) are now opt-in; core protections (SQLi, XSS, path traversal, prompt injection, rate limit, data leakage, file upload) stay on.
  • Outgoing fetch hook is monitor-only by default; blocking requires blockOutgoing: true.
  • Fixed: dataLeakageDetection: false now actually disables blocking; per-request context moved to AsyncLocalStorage (no more cross-request IP mix-ups under load).
  • Removed legacy /api/dashboard/sync call and the unused http-proxy dependency.
v1.0.0
2026-06-09

Initial public release

  • Runtime middleware for Next.js, Express, and Node.js.
  • OWASP Top 10 detection (SQLi, XSS, SSRF, prompt injection, and more).
  • Real-time telemetry to the Silker AI platform.
  • Cloudflare Worker deployment option and Docker proxy container option.
  • 26 test suites.