🛡️ Dependency Trap Code Guard

Autonomous Supply-Chain Auditing & On-Chain Defense Engine

Challenge 2 — Open-Source “Dependency Trap” Code Guard
Protects open-source maintainers and junior developers from deeply nested supply-chain backdoors, silent credential exfiltration, and malicious postinstall hooks by combining Google Gemma 4, Snowflake Cortex Copilot (CoCo) vulnerability pipelines, and immutable Solana Agent Registry validation signatures.

---

📜 Open-Source License Block (MIT)

MIT License — Copyright (c) 2026 Dependency Trap Code Guard Team
Permission is hereby granted, free of charge, to any person obtaining a copy of this
software and associated documentation files to deal in the Software without restriction,
including without limitation the rights to use, copy, modify, merge, publish, distribute,
sublicense, and/or sell copies of the Software. See ./LICENSE for full text.

---

⚡ Quick Start (Zero External npm install Bloat — Runs in 1 Second!)

Requires Node.js v22.5+ (built with native node:sqlite, node:crypto Ed25519, and node:test):

# 1. Run the automated security test suite (6/6 tests)
npm test

# 2. Register your Autonomous Security Agent on Solana Devnet
npm run register-agent

# 3. Start the interactive Security Command Center Dashboard
npm start

Open http://localhost:3000 in your browser!

---

🧩 Track Architecture & Mandatory Deliverables Verification

1. Google Gemma 4 Core Integration

• File: src/services/gemmaAssistantService.mjs
• How it works: When static & entropy analysis flags suspicious lines deep inside recursive dependencies (e.g., Base64 process.env serialization, ~/.config/solana/id.json harvesting, or hex-encoded eval()), our isolated GemmaAssistantService sends the exact raw lines and Snowflake advisory context to Google Gemma via the Gemini API (gemma-3-27b-it / gemma-4-27b-it) or local Ollama (gemma4), returning structured JSON with:
  • A plain-English headline & summary written specifically for junior developers
  • A line-by-line breakdown of what the obfuscated code actually does
  • Concrete remediation & secret-rotation steps

2. Snowflake CoCo Open-Source Security Datasets

• Files: snowflake/coco_security_pipeline.sql & src/services/snowflakeCocoService.mjs
• Dataset Reference: References freely accessible Open-Source Vulnerability Indexes (SNOWFLAKE_MARKETPLACE_OSV_OPENSSF_INDEX) structured via Snowflake Cortex Copilot (CoCo) into two core tables and a unified analytical view:
  • OSV_COMPROMISED_PACKAGES — Known CVEs, GHSA/OSV advisories, CVSS scores, and attack vectors.
  • PACKAGE_PUBLISHING_ANOMALIES — CoCo-engineered pipeline tracking dormant packages (>180 days) suddenly transferred to new maintainers with high Shannon entropy deltas or newly injected postinstall hooks.
  • VW_COCO_SUPPLY_CHAIN_RISK_FEED — FULL OUTER JOIN analytical view queried via Snowflake’s SQL REST API (/api/v2/statements) with an automatic local node:sqlite mirror for sub-millisecond offline/live reliability.

3. Solana Agent Identity & On-Chain Validation Logs

• File: src/services/solanaAgentRegistry.mjs
• How it works:
  • Generates a persistent 32-byte Ed25519 Solana Agent Keypair encoded in Base58.
  • Every scanned file produces a deterministic SHA-256 digest and canonical audit payload signed by the agent’s Ed25519 private key (crypto.sign / crypto.verify).
  • Supports live Solana Devnet Memo Program (MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr) transaction broadcasting (requestAirdrop + getLatestBlockhash + raw wire transaction sendTransaction) as well as verifiable Ed25519 signature simulation when venue Wi-Fi rate-limits public faucets.

---

🤖 4. How GitHub Copilot Accelerated Development (Mandatory Deliverable)

GitHub Copilot was instrumental across three critical engineering stages of Dependency Trap Code Guard:

1. Adapting to Recursive Package & Manifest Parsing APIs:

   • Challenge: Parsing heterogeneous multi-ecosystem dependency trees (package.json preinstall/postinstall lifecycle hooks alongside nested Python sub-dependencies) and computing per-literal Shannon Entropy without pulling heavy third-party AST dependencies (which could themselves introduce supply-chain bloat!).
   • How Copilot Helped: Using Copilot Chat, we prototyped lightweight regex + Shannon entropy tokenizers (computeShannonEntropy in src/services/dependencyScanner.mjs) and recursive manifest walkers (scanDirectoryTree), iterating rapidly to avoid false positives on normal URLs while catching Base64/Hex-encoded C2 endpoints.

2. Generating Subtle Mock Malicious Scripts (mock-traps/):

   • Prompt Used in Copilot:

     “Generate 3 realistic mock supply-chain trap files for testing our defensive scanner: (1) a Node.js timezone helper that subtly Base64-encodes process.env into a fake telemetry ping, (2) a postinstall.js script checking ~/.ssh and .config/solana/id.json disguised as a native binary prebuild check, and (3) a Python utility using bytes.fromhex() with eval(), plus 1 completely clean currency formatter baseline.”

   • Output: Produced the 4 realistic test packages under mock-traps/packages/ so we could safely benchmark detection accuracy without running real malware.

3. Generating the Automated Verification Suite (tests/scanner.test.mjs) & Raw Solana Wire Serializer:

   • Copilot accelerated writing compact-u16 binary encoding (encodeCompactU16) for raw Solana Memo transactions and generated our 6-part node:test verification suite (npm test), asserting Base58 keypair round-trips, zero false positives on clean code, Snowflake CoCo anomaly joins, and Ed25519 tamper rejection.