Code Guard audits an npm project’s entire dependency tree, including deeply nested packages, for known vulnerabilities, published malware, backdoor-like code and typosquatted names. It reads packages as text and never runs them.

Gemma 4 (gemma-4-26b-a4b-it, through the Gemini API) explains the top findings in plain language for junior developers. Severity never comes from the model, so a malicious package can’t talk its way out of a finding.

Each report’s SHA-256 hash can be recorded on Solana devnet by an agent registered on the Solana Agent Registry, and a verify command checks that record against the chain.

Status: the scanner, live OSV lookups, live Gemma calls and Solana registration and attestation have all run for real. Snowflake pipeline SQL is included but has not been run. CoCo was not used because the trial disables AI features without a credit card, and the organizers confirmed it could be skipped.