THE PROBLEM
Supply-chain attacks hide malicious code inside deeply nested sub-dependencies of public packages. Indie developers and open-source maintainers don’t have the time or budget to manually read millions of lines of recursive dependency code, leaving their users exposed to credential theft.

WHAT CODEGUARD DOES
CodeGuard walks a project’s entire dependency tree, at every nesting level, and audits each package automatically:

• Detects install-time scripts, environment-variable/secret access, network calls, eval, base64 obfuscation, access to credential files (.npmrc, SSH keys), shell commands, and typosquatted package names.
• Cross-checks every package against a known-compromised package index stored in Snowflake.
• Uses Gemma 4 to explain each risk in plain English for junior developers: what it does, why it’s dangerous, and what to do.
• Signs and records every verdict onchain on Solana, creating an untamperable audit log, plus a local hash chain that detects any edited record.

In our demo, CodeGuard catches a hijacked package hidden 3 levels deep (express-lite > body-helper > string-padder) and a typosquat of axios, while correctly marking all clean packages as safe.

HOW WE USED EACH TRACK

• Google Gemma 4: gemma-4-26b-a4b-it via the Gemini API generates plain-English vulnerability explanations from raw code evidence.
• Snowflake: the agent queries CODEGUARD_DB.SECURITY.KNOWN_COMPROMISED_PACKAGES live at runtime through a read-only role; the repo includes the pipeline SQL and anomaly views (malware packages, publishing bursts, typosquat suspects) based on the OSV.dev open-source vulnerability dataset. We attempted to use Cortex Code (CoCo), but it is not enabled on trial accounts, so the SQL was written by hand.
• Solana: the agent has its own keypair identity and writes each verdict’s SHA-256 hash to Solana devnet via the Memo program. Live proof: https://explorer.solana.com/tx/3JuZbovENJFQ37E6gBNzAQP6bUHnPm3ZrSopkLWv9ZMd9sqRfw1gupEb9nNXbdjGyezcdAMkaYigW6rDc1uZjRTq?cluster=devnet
• GitHub Copilot: helped us work with unfamiliar APIs (recursive node_modules parsing, Solana transaction building with solders), generate inert mock packages containing subtle security flaws, and build a 7-test suite proving the engine catches every planted flaw with no false positives.

BUILT WITH
Python, Gemma 4 (Gemini API), Snowflake, Solana devnet (solders, Memo program), GitHub Copilot, pytest. MIT licensed.