Code-Muhafiz — Gemma 4 reads your dependencies so you don’t have to.

Code-Muhafiz (“code guardian”) is an open-source supply-chain security agent built for Challenge 2, “Dependency Trap” Code Guard. Attackers hide backdoors deep inside nested sub-dependencies, and most maintainers don’t have the time to read millions of lines of code. Code-Muhafiz reads it for them.

Point it at a public GitHub repo or upload a project folder. It parses package.json, package-lock.json and requirements.txt, including transitive dependencies, and flags:

• Known vulnerabilities and malicious packages, from the OSV.dev database
• Compromised packages, from a threat-intel dataset of real incidents (event-stream, ua-parser-js, the 2025 chalk/debug hijack)
• Typosquats, such as crossenv imitating cross-env or reqeusts imitating requests
• Dangerous install scripts, such as a postinstall that runs curl … | sh
• Suspicious code: obfuscated eval, environment variables sent to the internet, credential-file reads, exfiltration webhooks

Findings appear in seconds with a 0–100 risk score. Google Gemma 4 (gemma-4-31b-it, with gemma-4-26b-a4b-it as a fallback, via the Gemini API) then explains the risks the way a senior developer would to a junior one: what it is, why it’s dangerous, and how to fix it. A per-finding “Explain” button gives a deeper explanation of any single finding.

Every report is hashed with SHA-256 and signed by the agent’s own ed25519 identity into a hash-chained audit ledger, so anyone can later confirm a report hasn’t been altered. Code-Muhafiz never installs or executes scanned code; it only reads text.