Hijack Radar

Project intro

Hijack Radar is an agent that traces phished npm maintainers and hijacked releases through a FalkorDB graph of your real, installed dependency trees — and shows the path behind every answer. CVE scanners answer which of your pinned versions is vulnerable; Hijack Radar answers the questions they cannot: if a maintainer's account is phished, what can the attacker publish into your repos? Would your next npm update install the hijacked release? Where is your next xz? Its radar view draws the 17 demo repos as dots on a radar, one ring per dependency hop, and a sweep lights up every exposed repo on the ring the graph reaches. Concretely: only playwright declares debug, but the graph shows all 17 repos install it; the September 2025 debug@4.4.2 hijack finds 217 semver ranges that would accept the bad version on a lockfile refresh; and a phished qix account reaches all 17 repos. Every answer carries its path, outcomes are honest (answered, not_in_graph — never 'safe' — or unknown_*), and triage decisions are stored as dated Decision nodes that come back in later answers. The current demo graph covers 17 repos, 6,637 packages, 11,179 versions, 33,233 DEPENDS_ON edges and 357 advisories, and the agent can be used over MCP from Claude Code or Claude Desktop, or through its web UI. Built during Graph Hacks: Context for AI Agents (FalkorDB x WeMakeDevs), 2026-10-16 to 18, with Claude Code as coding assistant. It runs locally (uv + embedded FalkorDBLite, no Docker or cloud account needed) or deploys free to FalkorDB Cloud + Render; the demoUrl here is the GitHub repo because there is no verified standalone hosted demo — see notes.md.