Inspiration

Modern software infrastructure relies heavily on single-maintainer open-source repositories. Attackers increasingly exploit maintainer burnout through social engineering and sockpuppet accounts to compromise maintainer credentials—exemplified by the xz-utils backdoor (CVE-2024-3094).

Existing security scanners operate reactively after malicious code is published. Ghost Maintainer is an AI-native early-warning engine that predicts open-source supply chain failure pre-CVE by evaluating zero-trust developer behavioral signals and linguistic sentiment drift directly from public GitHub event streams.

What It Does

Ghost Maintainer continuously ingests raw GitHub developer telemetry (commits, pull requests, issue threads, and comments) to calculate a deterministic Risk Score (0–100) via a weighted linear combination: R = 0.5 × S_linguistic + 0.5 × S_velocity

1. Linguistic AI Analysis (Quantized Gemma 4B via Ollama & Snowflake Cortex): Evaluates sentiment divergence, maintainer exhaustion indicators, and hostile commit-privilege escalation patterns using structured JSON schema inference.
2. Behavioral SQL Window Functions: Calculates 5 statistical anomaly vectors in Postgres/Snowflake:
   • Activity Drop: 30-day commit volume velocity drop against historical baseline.
   • Commit Time Shift: Active UTC hour distribution drift ($L_1$ Wasserstein distance).
   • New Author Surge: Moving-average spike of merged commits from unverified contributors.
   • Unreviewed Merges: Ratio of pull requests merged bypassing review comments/approvals.
   • Reply Latency Spike: Z-score anomaly on maintainer issue first-reply latency.

How We Built It

• Frontend & Dashboard: Built with Next.js 16 (App Router), React 19, TypeScript, and Tailwind CSS 4, featuring real-time risk gauges and interactive manifest triage.
• AI & Inference Engine: Offline LLM scoring powered by Gemma 4B via Ollama REST IPC (web/src/lib/gemma/score.ts) and Snowflake Cortex AI (sql/03_cortex_scoring.sql).
• Data & Analytics Layer: Dual-database architecture using PostgreSQL (Supabase RLS) and Snowflake Data Warehouse with raw VARIANT JSON normalization (sql/02_flatten_views.sql) and window function windowing (sql/04_behavior_signals.sql).
• Terminal CLI Suite: Portable Node.js (cli/scan.mjs) and Python (cli/scan.py) scanners for local execution and CI/CD pipeline integration.

Track Alignment

• Best Use of Gemma 4 (Google DeepMind): Executes local, privacy-friendly quantized Gemma 4B inference for zero-leakage linguistic sentiment and exhaustion classification.
• AI in Cybersecurity (OWASP JIS University): Implements proactive pre-CVE supply chain protection to flag compromised maintainer accounts and unauthorized binary payload merges.
• Best Open-Source AI Project with Snowflake: Runs in-warehouse statistical windowing and Snowflake Cortex AI Gemma evaluation directly over raw GitHub telemetry.
• Best Open-Source AI Project (DigitalOcean): Fully open-source under the MIT license with complete web, CLI, and database artifacts.