Hey folks! Sharing something I've been working on. Like a lot of devs lately, I've been seeing more cases of "slopsquatting": AI coding assistants confidently suggesting package names that look real but don't exist, which then get registered by bad actors. A few have already made it into production package.json/requirements.txt files. So I built DevHorrors, a free scanner that checks your manifest (npm, PyPI, Go, RubyGems) against a curated database of known hallucinated, typosquatted, and malicious packages. It also has a "Roast Engine" that gives you a (darkly humorous) security critique of your dependencies, alongside the actual remediation steps. What it does: - Paste/upload a manifest or repo → instant risk report per dependency - Hallucination-confidence scores and the legitimate package to swap to - A public threat feed + community "horror stories" from devs who got hit - Free API + CLI for CI/CD It's free to use; there's a paid tier for team monitoring, Slack/Discord alerts, and GitHub PR blocking. I'm genuinely curious how others are handling this — is anyone here actively checking for AI-hallucinated packages in their pipelines, or relying on registries to catch it? Site: devhorrors.com · would love honest feedback, especially on what's missing for your stack. Thanks! Have a good day!

DevHorrors

Catch AI-Hallucinated & Slopsquatted Code

Catch AI-Hallucinated & Slopsquatted Code