Introduction

OPM is a drop-in npm replacement that adds cryptographic signing, multi-agent AI security scanning, on-chain risk scoring, and ZK-verified agent registration to the JavaScript supply chain.

Introduction

OPM (On-chain Package Manager) is a drop-in npm replacement that scans every package with 3 AI agents, scores risk on-chain, and blocks malicious installs — all from the terminal.

The Problem

npm has no built-in defense against supply chain attacks. Developers install typosquatted packages, ship unpatched CVEs, and run malicious postinstall scripts — often without knowing until it’s too late. Traditional tools catch known vulnerabilities after disclosure, but miss novel threats, obfuscated payloads, and social engineering attacks.

How OPM Fixes It

Layer	What it does
Cryptographic signing	SHA-256 checksum + ECDSA signature from your Ethereum wallet, verified at install time
Multi-agent AI scanning	3 LLMs (Claude, Gemini, DeepSeek) analyze packages in parallel — catches what static analysis misses
On-chain registry	Risk scores, author profiles, and audit reports stored on Base Sepolia — immutable and queryable
ZK agent verification	Anyone can register a security agent, but must prove 100% benchmark accuracy via zero-knowledge proofs
ENS identity	Author reputation tied to ENS names — decentralized trust, not centralized accounts

Key Integrations

Integration	Purpose
Base Sepolia	On-chain registry for scores, packages, and agents
ENS	Author identity and package metadata records
Fileverse	IPFS-backed encrypted audit report storage
OSV	Real-time CVE/GHSA data
ChainPatrol	Blocklist fallback for unregistered packages

Architecture

OPM implements the ERC-8004 (Trustless Agents) pattern — agents hold on-chain identities, submit risk scores, and attach Fileverse reports as validation evidence.