{
  "id": 6107346,
  "title": "New GitHub project",
  "url": "https://urgent.news/2026/09/07/new-github-project",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-07T06:23:12.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/banana_cool/new-github-project-5b5a"
  },
  "original_language": "en",
  "account": "Authtics Advisories is a new GitHub project that uses AI to scan malicious packages from package registries. The system, created by user bananakitssu, analyzes packages from PyPI and NPM registries every day. It selects 100 packages from each registry and runs them through a Gemini analysis pipeline. The output is then presented as a GitHub pull request for human review, rather than being automatically classified as a security advisory by the AI model.\n\nThe workflow of Authtics Advisories is designed to provide humans with a report of potentially suspicious packages, rather than treating AI analysis as a definitive statement. The system doesn't scan the registries simultaneously, but runs the NPM scan first, followed by the PyPI scan approximately two hours later. This separation allows for better management of the scanning process.\n\nThe time it takes for a complete scan can range from 30 minutes to an hour, depending on the number of packages analyzed. Each individual package analysis typically takes between 2 to 60 seconds. Despite the AI's role in initial analysis, it doesn't replace human security researchers. Instead, it serves as a tool to help identify areas worth investigating. Currently, Authtics Advisories focuses on NPM and PyPI registries, but the developer plans to expand it to include more registries and improve analysis capabilities. The project is still in its early stages, with the initial goal of providing a daily scan of suspicious packages and opening a dialogue between the AI system and human reviewers.",
  "summary": "I Built an AI-Powered Daily Scanner for Malicious Packages I just made another thing. 💀 This time, it's Authtics Advisories — and no, this isn't the Authtics from authtics.com. authtics.com is another website by someone else. I built a system that uses Gemini to automatically scan package registries for potentially malicious packages and create reports for humans to review. GitHub:…",
  "key_points": [
    "Authtics Advisories uses AI to scan malicious packages from PyPI and NPM registries.",
    "System analyzes 100 packages daily from each registry using Gemini analysis pipeline.",
    "Output presented as GitHub pull request for human review, not automated classification."
  ],
  "editors_take": "This project shifts the role of AI in security analysis from making definitive judgments to supporting human reviewers by identifying potentially suspicious packages for further investigation.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}