Like a lot of devs lately, I've been seeing more cases of "slopsquatting": AI coding assistants confidently suggesting package names that look real but don't exist, which then get registered by bad actors. A few have already made it into production package.json/requirements.txt files.
So I built DevHorrors, a free scanner that checks your manifest (npm, PyPI, Go, RubyGems) against a curated database of known hallucinated, typosquatted, and malicious packages. It also has a "Roast Engine" that gives you a (darkly humorous) security critique of your dependencies, alongside the actual remediation steps.
What it does:
- Paste/upload a manifest or repo → instant risk report per dependency
- Hallucination-confidence scores and the legitimate package to swap to
- A public threat feed + community "horror stories" from devs who got hit
- Free API + CLI for CI/CD
It's free to use; there's a paid tier for team monitoring, Slack/Discord alerts, and GitHub PR blocking. I'm genuinely curious how others are handling this — is anyone here actively checking for AI-hallucinated packages in their pipelines, or relying on registries to catch it?
Site: devhorrors.com · would love honest feedback, especially on what's missing for your stack.
Thanks! Have a good day!
SOCIAL SHARE CARD GENERATOR