excubiae-ai

Save yourself from npm scam, Use xbe to keep your jam!

Comment

Inspiration

Modern software depends heavily on open-source packages, yet developers often install dependencies with little visibility into their security and trustworthiness. Recent supply chain attacks have shown that a single compromised package can create impact thousands of downstream applications and cause huge financial losses.

I built Excubiae AI with Codex from scratch to help vibe coders and AI-reliant developers make informed decisions before installing a package by providing an trust score based on test instead of relying solely on manual research or post-installation vulnerability scans.

What it does

Excubiae AI is an AI-powered npm package trust analyzer that evaluates the security posture of npm packages before installation.

It analyzes:

  • Package metadata
  • Lifecycle scripts
  • Dependency complexity
  • Historical security intelligence
  • Curated malicious package intelligence

to generate an explainable trust score.

Developers can use either the web dashboard or the CLI to analyze packages and understand exactly why a package is considered safe or risky.

Instead of returning a simple pass/fail result, Excubiae AI provides transparent reasoning behind every trust score.

How I built it

Excubiae AI is built as a modular TypeScript monorepo consisting of reusable packages for metadata retrieval, parsing, trust analysis, and user interfaces.

Architecture

npm Registry
      │
      ▼
Metadata Parser
      │
      ▼
Trust Engine
 ├── Metadata Analysis
 ├── Lifecycle Script Analysis
 ├── Dependency Analysis
 ├── Historical Intelligence
 └── Malicious Package Intelligence
      │
      ▼
Explainable Trust Report
      │
 ┌────┴────┐
 ▼         ▼
CLI     Web Dashboard

The frontend is built using:

  • Next.js
  • React
  • Tailwind CSS

The backend logic is shared between the CLI and the web application.

OpenAI Codex was used extensively throughout development to accelerate architecture design, debugging, refactoring, CLI improvements, and production-ready implementation.

Challenges I ran into

One of our biggest challenges was designing an explainable trust engine instead of a black-box AI system.

Every trust decision needed to be transparent and reproducible, requiring carefully designed deterministic security heuristics.

Other challenges included:

  • Maintaining a shared architecture between the CLI and web application
  • TypeScript ESM module resolution issues
  • Package linking across a monorepo
  • Ensuring consistent trust analysis across all interfaces
  • Deployment and production integration

Accomplishments that I am proud of

  • Built a complete end-to-end npm package trust analysis platform.
  • Designed an explainable trust engine instead of opaque AI scoring.
  • Integrated historical package intelligence and malicious package detection.
  • Delivered both a polished CLI and responsive web dashboard.
  • Created a modular architecture that is easy to extend with future intelligence sources.

What I learnt

This project reinforced the importance of explainability in AI-assisted security tools.

Rather than replacing developer judgment, AI is most valuable when it helps explain why a package should or should not be trusted.

I also learnt valuable lessons about:

  • Modular TypeScript monorepos
  • Shared package architectures
  • Developer tooling and CLI UX
  • Security heuristic design
  • Rapid software development using OpenAI Codex

What's next for Excubiae AI

My roadmap includes:

  • Real-time threat intelligence feeds
  • Maintainer reputation analysis
  • AI-generated remediation recommendations
  • GitHub repository and commit history analysis
  • CI/CD integrations
  • Enterprise dashboards
  • Support for PyPI, Maven, Cargo, NuGet, and other package ecosystems

Built With

  • TypeScript
  • Node.js
  • pnpm
  • Next.js
  • React
  • Tailwind CSS
  • OpenAI Codex
  • OpenAI API
  • ChatGPT
  • Vercel
  • npm Registry API

Built With

Share this project:

Updates