The clock starts. You have exactly 12 hours. The mission? Build something that solves a real-world problem before the caffeine wears off.
For our team—commit-tee—the problem we wanted to tackle was staring us right in the face every time we ran npm install. The open-source ecosystem is the backbone of modern software, but it has a massive blind spot: supply chain security. We decided to spend our 12-hour hackathon building pkgtruth., an AI-driven scanner designed to hunt down malicious packages on GitHub and package registries before they can compromise your codebase.
The Problem: Trusting the Untrustworthy
Modern applications rely on thousands of transitive dependencies. But what happens when a trusted maintainer's account gets compromised, or a threat actor publishes a typo-squatted package?
Recent history proves this is a critical threat. We've seen massive supply chain attacks where threat actors compromise popular npm packages (like the recent breaches affecting chalk, debug, and the Shai-Hulud worm) to inject malicious post-install scripts and steal environment secrets. Developers are often flying blind, blindly trusting that the packages they import are safe.
Enter pkgtruth.
We built pkgtruth. to act as your AI security analyst for open-source dependencies. Instead of manually auditing a package's repository, reading through minified code, or checking a maintainer's publish history, pkgtruth. automates the threat hunting.
Here is what we managed to build in just half a day:
Automated Suspicion Scoring: The tool ingests a package name and scans its GitHub repository and registry data, looking for red flags like sudden changes in maintainers, dormant packages suddenly releasing new major versions, or obfuscated code patterns.
AI-Powered Threat Reports: Instead of just giving a pass/fail grade, pkgtruth. leverages AI to generate a comprehensive, human-readable security report. It explains why a package is flagged as suspicious.
Vulnerability Breakdown: The report highlights potential attack vectors, such as hidden execution scripts, network exfiltration attempts, or hardcoded malicious payloads.
Under the Hood: The 12-Hour Sprint
Building an AI analysis tool in 12 hours is a chaotic orchestration of API calls and prompt engineering. We had to connect GitHub's API to pull repository metadata, fetch package tarballs, and pipe the most critical context into an LLM to generate the final threat analysis.
The biggest challenge was tuning the AI to avoid false positives. Not every obfuscated script is malware—sometimes it's just a heavily optimized bundler. By narrowing our AI prompts to focus on specific supply chain attack vectors (like unauthorized API calls or credential harvesting patterns), we drastically improved the accuracy of the pkgtruth. reports.
What's Next for commit-tee?
Submitting pkgtruth. at the 11th hour was a rush, but we genuinely believe in the tool's potential. Supply chain attacks are only going to get more sophisticated, which means our defense mechanisms need to evolve from static signature scanning to intelligent, AI-driven behavioral analysis.
We're exhausted, over-caffeinated, and incredibly proud of what we built. Check out our repository, run pkgtruth. against your latest dependencies, and let us know what you find!
Top comments (0)