AIRLOCK
A safety gate that stands in front of every package an AI agent installs. Each candidate is detonated in a throwaway Daytona sandbox seeded with honeytoken credentials, read line-by-line by a code model on a rented GPU, and reputation-checked against the live web — then a judge weighs all of it and blocks or passes, in plain language the agent understands.
SOURCE ON GITHUB
THE VERDICT — TRIPWIRES, SOURCE RATING, BLOCK
THREE CHECKS BEFORE ANY INSTALL
THE PROBLEM — 34,319 IN ONE QUARTEREvery time an AI agent runs a package install, it trusts a stranger's code to execute on your machine — unattended, at full speed, at 2am. Airlock is the checkpoint that stands in the way: it takes each package somewhere disposable, runs it, reads it, and decides whether it is trying to hurt you before it ever reaches your real machine.
The problem
Registry poisoning is the fastest-growing corner of software security — Sonatype counted 34,319 new malicious packages in a single quarter of 2025, and in March 2026 one landed in npm right next to Claude Code itself. Agents make it worse: they install faster than any human, with nobody watching. Most tooling stops at reading a package and guessing.
Approach
- Detonation: a fresh Daytona sandbox spins up in ~0.7s, seeded with honeytoken credentials as bait, and the package is installed while every file read, outbound connection and shell spawn is watched.
- Static reading: Qwen 3.5 on a rented Nosana GPU reads the entire source — including the branches a short test run never reaches, which is exactly where sleeping attacks hide.
- Similarity: Doubleword embeddings fingerprint the code against known malware, catching repackaged attacks that only reworded a known trick.
- Reputation: Oxylabs scans the live web for what is already known about the package, so brand-new attacks that no advisory database lists yet still get caught.
- A judge weighs all four signals — but sits on a floor made of plain code, not AI. Reading planted bait, phoning home or opening a shell during an install is an instant block on its own, and the model can only ever make the gate stricter.
Results
A typosquatted python-pillow is caught, blocked and explained in plain language the agent can act on, while safe packages pass through with no noise at all. Built at the Daytona HackSprint in Singapore and took the overall grand prize.