OSS Artifact Scanning at Scale Without Burning Your Token Budget

This report describes a production pipeline that indexes, scans, and triages artifacts from ten registries using deterministic THOR rules to prefilter findings and an LLM-based triage plus an on-demand agent (RuneAI) for deeper analysis; it presents a real detection where a malicious VS Code extension bundled Rust-built implants (Windows PE and macOS Mach-O) with GlassWorm overlap and notes the pipeline has reported more than 100 malicious packages across npm, VS Code/OpenVSX, and PyPI, explaining tradeoffs, costs, and limitations of rule-first design.