Inspiration
The inspiration for Supply Chain Sidecar stems from a massive blind spot in modern AI-driven application security: The Halo Effect
Traditional AI classifiers and LLM security tools look at a file like package.json and try to detect malicious intent based entirely on code structure, known malware databases or intended behaviours. Yet attackers have figured this out and use increasingly sophisticated exploits. In a manifest-only hijack modelled after the recent Axios 1.14.1 attack (March 2026) compromised maintainer accounts were used to publish malicious code hidden under trusted, high-reputation names. Because the manifest content looked completely identical to a legitimate release, an AI model evaluating that text would confidently mark it as 'SAFE'. But the signal isn't in the package content; it's in the out-of-band registry metadata.
What it Does
Supply Chain Sidecar acts as an automated, intercept-time validation layer that catches what AI models miss. It acts as a local proxy that hooks into npm install requests.
While Gemini 2.5 Flash evaluates the manifest code, the Elastic MCP Server simultaneously fires off a fast suite of targeted enrichment checks. It aggregates live weighted signals such as missing Git tags, anomalous publishing methods, or newly registered author domains to establish a unified Enrichment Confidence Score. If the registry evidence indicates a hijack, it triggers an immediate safety override, turning a false-positive AI 'SAFE' into an 'MALICIOUS' block before the dependency ever touches the production environment.
How We Built It
The architecture is fully deployed, cloud-native, and lightning fast:
- Proxy Intercept: A lightweight Python proxy hooks into the local package manager stream.
- AI Engine: Gemini 2.5 Flash hosted on Vertex AI handles the initial baseline manifest evaluation.
- Data Layer & Cache: Elastic Cloud handles sub-millisecond cache reads. Package reputation signals are indexed as structured documents so live npm registry and RDAP calls only happen once per package version, completely neutralising any network latency.
- Deployment: Fully orchestrated using a Flask container deployed to Google Cloud Run.
Challenges We Faced
Building an automated defense layer that operates seamlessly at intercept time forced us to overcome three major architectural hurdles:
Neutralising the Model's Halo Effect Blind Spot: During empirical testing, we discovered that Gemini 2.5 Flash exhibited non-deterministic behaviour on high-reputation manifests. For instance, it would occasionally flag clean, legacy versions of a package like
axiosas malicious simply due to prompt variance, yet miss a structurally identical, compromised version. We realised we couldn't rely on the LLM as the final word. Our breakthrough was an architectural pivot: for high-reputation packages, we made the live Elastic MCP evidence completely authoritative, reducing the generative AI verdict to an advisory signal.Calibrating Signal Weights Against Real Data: Our initial scoring logic was far too aggressive. For example, we initially heavily penalised packages published via a
manual_token. However, real registry data quickly reminded us that a massive percentage of open-source maintainers still publish manually, meaning our tool was causing major false positives on clean packages. We had to carefully re-calibrate our aggregate enrichment confidence matrix so that trusted baselines safely resolve below our strict thresholds ($0.20$), while real-world structural mutations (like a missing Git tag combined with an unknown method) cross the threshold ($0.60$) to trigger an override.Simulating Non-Existent Attacker Infrastructure: To truly test the system against the real-world metrics of the March 2026 Axios incident, we needed to evaluate malicious author domains. However, active threat domains are quickly taken down by registries, and registering fresh malicious infrastructure for a hackathon demo would be highly inappropriate. Instead of hardcoding cheap shortcuts, we built a rigorous synthetic injection framework grounded in the exact data patterns observed in actual incident reports. This safely and accurately replicates what our Elastic cache yields in a live enterprise production environment.
What We Learned
We proved that AI security tools shouldn't be treated as the final word, they are simply another signal. Designing an architecture around Model Context Protocol allowed us to dynamically expose system-level tools directly to our agent assessment pipeline rather than relying on sluggish post-hoc lookups.
What's Next for Supply Chain Sidecar
We plan to expand our Elastic MCP server capabilities to support PyPI and Cargo ecosystems. Additionally, we want to implement advanced telemetry sharing, allowing enterprise teams running sovereign, air-gapped Elastic deployments to share local threat caches across isolated networks automatically.
Log in or sign up for Devpost to join the conversation.