CGSEC

ChainGate by CGSEC

Every release
has a history.

ChainGate compares npm releases with recorded package history. Runtime brings checks into the install path; Ops collects and analyzes the observations behind them.

Explore RuntimeExplore Ops
Inside an npm request
Solid arrows carry npm requests from your project through ChainGate Runtime to the registry, and responses back along the same path. Dashed arrows connect the local witness history and an optional, locally supplied v3 detection seed directly to Runtime. Runtime evaluates the metadata and produces a result with reasons. Default checks do not require a v3 seed.
Local witness historyPrior observations
V3 detection seedOptional · local file
npmYour project
ChainGate RuntimeEvaluate metadata
registryMetadata
Result + reasons
ALLOWWARNBLOCK
Requests / responsesLocal evidence

Latest research

A reproducible archive lookup and hash check for a removed npm entry point.

Two parts. Different jobs.

ChainGate Runtime

Public code · Apache-2.0

A local npm proxy and CLI for developers and security engineers. Install the CLI and inspect a saved result; the Runtime page explains what fresh evaluation needs.

See what you can run

ChainGate Ops

Private collection and analysis

Registry collection, retained release history, change analysis, and seed generation. See the implemented components and how their outputs relate to Runtime.

Understand the operational side

An independent project by Rizwan Bedekar.

View ChainGate on GitHub