New GitHub project

I Built an AI-Powered Daily Scanner for Malicious Packages

I just made another thing. 💀

This time, it's Authtics Advisories — and no, this isn't the Authtics from authtics.com. authtics.com is another website by someone else.

I built a system that uses Gemini to automatically scan package registries for potentially malicious packages and create reports for humans to review.

GitHub: https://github.com/bananakitssu/found-malicious-packages

What does it do?

Right now, Authtics Advisories scans two registries:

• PyPI
• NPM

Every day, it selects 100 packages from each registry and sends them through the analysis pipeline.

It also analyzes my own packages.

The important part is that the AI isn't supposed to be the final authority.

Instead, the workflow generates a report and opens it as a pull request for human review.

So the general flow looks like:

Package registry
      ↓
Select packages
      ↓
Gemini analysis
      ↓
Generate report
      ↓
Open GitHub PR
      ↓
Human review

That means a suspicious result doesn't automatically become a security advisory just because an AI model said so.

The scanning schedule

The registries aren't scanned simultaneously.

The system runs the NPM scan first.

Then, approximately 2 hours later, it starts the PyPI scan.

This gives the workflow some separation between the two registry scans instead of trying to do everything at once.

How long does it take?

A complete scan can take anywhere from 30 minutes to an hour.

Individual package analyses can take roughly 2–60 seconds, depending on the package and analysis.

And since it's analyzing 100 packages per registry, those little delays add up pretty quickly.

💀

Why use AI for this?

Package registries are enormous.

Trying to manually inspect packages every day obviously doesn't scale for one person.

AI gives me a way to automate the initial analysis and surface packages that deserve another look.

But there's an important distinction:

AI analysis ≠ confirmed malicious package.

The system is intended to help find things worth investigating, not replace human security researchers.

That's also why the output goes through GitHub pull requests.

The human reviewer gets the final say.

What's next?

Right now, it's focused on NPM and PyPI.

I'd like to eventually expand the system with more registries, better analysis, and more ways of correlating suspicious behavior between packages.

For now, though, I'm happy with having a little robot that wakes up every day and goes:

"Hmm... this package looks suspicious."

And then bothers a human about it. 💀

I'm also planning to make something called Authtics NPM.
The idea is to add an advisory check when installing NPM packages, so potentially suspicious packages can be flagged during installation instead of only being discovered during the daily registry scans.

Basically:

npm install some-package
        ↓
Authtics NPM checks advisories
        ↓
⚠️ Potential security issue

If you're interested in the project, Authtics Advisories, the source is here:

https://github.com/bananakitssu/found-malicious-packages

Feedback is welcome.