Gatekeeper

Open-source npm malware detection on Meta's models: a live monitor that flags new malware about a day before the public lists, a Muse agent that investigates a package like an analyst and has every claim checked by code, and an install guard that stops malware on your machine, offline, even when an AI agent runs npm install. Gatekeeper reads every new npm release as it is published (about 80,000-100,000 versions a day) without ever running it. Metadata, static rules, a fast classifier and a fine-tuned Llama Guard 3 narrow the stream; Muse Spark Open judges every flag, Muse Spark gives a second opinion, and Muse Glimmer 30B runs locally. Every verdict must cite the lines of code it is based on, and text inside a package that tries to talk the reviewer out of a block is treated as evidence, not as an instruction. Results from the live run (Oct 27-Nov 3): 48 packages (117 versions) the monitor flagged have been independently confirmed as malware by OSV/OpenSSF, GitHub or npm. Every release was flagged before anyone reported it, by a median of 14 hours, and a median of 25 hours before OSV, GitHub or npm listed it; median time from publication to flag about one minute. Flag times are committed as salted hashes to a public ledger before any confirmation and anchored in Bitcoin via OpenTimestamps, so the lead can be checked by anyone. Live recall is measured too: of the malware published while the monitor ran, it flagged 48% (46 of 96; 24 of the misses are one probe campaign that never reached the monitor), and the live page lists every miss. 14 packages were reported to OpenSSF, 3 already accepted, one of them filed by Gatekeeper on its own. The investigator is a Muse agent that works through a package step by step: it reads files, searches, has strings decoded and sees what a version adds compared with its predecessor. Claims are checked by plain code (citations exist, install claims are reachable through the require graph). Judges can try it on any npm package, no account: https://lb2002--gatekeeper-api.us-east.modal.run/try Its best find: a campaign that ships no malware at all, only a require of a private package nobody can read. Gatekeeper flags that gap, and following the campaign through npm turned up 8 unreported packages and 5 new private scopes (ossf/malicious-packages#1694). On your machine: uv tool install git+https://github.com/lb2002/gatekeeper, then gk guard setup (about 30 seconds, no account, no key, no GPU). The install guard wraps npm/npx for people and coding agents (demoed with Muse Code): known-malicious packages are blocked offline from a local copy of OSV's 222k malicious npm names; everything else is read in memory and judged by Muse Glimmer on the laptop, or by the hosted investigator. gk audit checks a project's lockfile and also runs as a GitHub Action. What existed before: nothing of this project; everything in the repository was written during the hackathon (Oct 27-Nov 4). Reused as libraries and data: GuardDog ideas, the DataDog malicious-packages dataset for evaluation, OSV/OpenSSF data, llama.cpp. See PRIOR_WORK.md. Live page: https://lb2002--gatekeeper-api.us-east.modal.run/