> ## Documentation Index
> Fetch the complete documentation index at: https://opm.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Model

> Five layers of defense: crypto, AI, CVEs, supply chain checks, and ENS trust.

# Security Model

OPM layers five independent defenses. No single layer is sufficient — together they catch supply chain injection, typosquatting, dependency confusion, maintainer takeover, and known CVEs.

## 1. Cryptographic Signing

Every package gets a SHA-256 checksum and ECDSA signature (secp256k1) from the author's Ethereum wallet. Both are stored on-chain and verified at install time. Tampered tarballs are rejected.

## 2. Multi-Agent AI Scanning

Three LLMs (Claude, Gemini, DeepSeek) analyze source code, dependency metadata, and version history in parallel. Each submits a risk score (0-100) on-chain. Scores are aggregated using intelligence-weighted averaging via the Artificial Analysis API.

Agents flag: install scripts, native bindings, obfuscated code, network calls, filesystem access, process spawning, `eval` usage, and env var access.

## 3. CVE Detection

Real-time lookup against the OSV database (CVE + GHSA advisories) with CVSS v3 severity scoring. CRITICAL CVEs block installation. HIGH CVEs trigger warnings with suggested fix versions.

## 4. Supply Chain Checks

| Check | How |
| - | - |
| Typosquatting | Levenshtein distance against top npm packages + AI name similarity assessment |
| Dependency confusion | Scoped vs unscoped name conflicts surfaced during `opm check` |
| ChainPatrol blocklist | Fallback for packages not in the on-chain registry |

## 5. ENS Trust Layer

Author addresses resolve to ENS names. Reputation is computed as the average risk score across all published packages. ENS text records (avatar, GitHub, Twitter) provide human-verifiable identity signals.

## Risk Thresholds

| Score | Level | What happens |
| - | - | - |
| 0–20 | LOW | Safe to install |
| 21–40 | MEDIUM | Flagged for caution |
| 41–70 | HIGH | Warnings triggered |
| 71–100 | CRITICAL | High risk |
| **≥ 80** | — | **Blocks `opm push` and `opm install`** |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.