Stop the package your agent invented.

One command. Nothing to sign up for.

Python 3.9 or newer. It runs where your agent or CI runs, and asks the public registries directly.

pip install "git+https://github.com/rxslice/pkgguard-API.git"
pkgguard check -e npm react-codeshift lodash

BLOCK  react-codeshift  [npm]  risk=100
       - Name appears on the known-hallucination corpus.
       - Name appears to blend 2 real packages (jscodeshift, react) into a
         combination that does not exist.
       - Only a single published version, with no release history.
       - Low adoption: 22 downloads in the last month.
       - No source repository linked in the registry metadata.
ALLOW  lodash  [npm]  risk=0
       - Established package with no risk signals.

2 checked | 1 blocked | 0 review | 1 allowed

AI can invent a package that sounds real.

Slopsquatting is the supply-chain attack that follows: an attacker registers a name an AI is likely to hallucinate, and the install command brings it into your build. Autonomous agents now run those commands themselves, so the human who used to glance at them is gone. Typosquat scanners miss the common case, because an invented name that blends two real ones is not a misspelling of either.

Measured against real registries.

Benchmarked on live registry data, not synthetic fixtures, and reproducible with one script in the repository.

The first version of the conflation check scored 0% false positives, and that test was worthless: it ran on packages the popularity corpus short-circuits. Run honestly on 800 packages outside it, the same check flagged 62.5% of legitimate names. Two changes brought it to 1.0%: conflation can no longer block on its own, only alongside weak reputation, and typosquats are measured by a name's share of its namesake's downloads rather than by spelling.

python scripts/benchmark.py --sample 200

Wherever the install happens.

pkgguard check -e pypi requests-oauth2-helper
echo "npm install react-codeshift" | pkgguard scan-command
pkgguard scan-manifest requirements.txt

pkgguard-gate -- npm install react-codeshift
pkgguard authorize "uv add requests"

pkgguard-mcp

- uses: rxslice/pkgguard-API/.github/actions/scan@main
  with:
    manifest: package.json

pip install "pkgguard[api] @ git+https://github.com/rxslice/pkgguard-API.git"
uvicorn pkgguard.api:app --port 8000

curl -X POST http://127.0.0.1:8000/v1/agent/authorize \
  -H "Content-Type: application/json" \
  -d '{"command":"npm install react-codeshift lodash"}'

curl -X POST http://127.0.0.1:8000/v1/verify \
  -H "Content-Type: application/json" \
  -d '{"names":["react-codeshift","express"],"ecosystem":"npm"}'
→ { "blocked": 1, "allowed": 1, "safe_to_proceed": false, ... }

Every point is explained.

BLOCK at 60 or more, REVIEW at 25 or more, otherwise ALLOW. A registry that cannot be reached never produces ALLOW: it produces REVIEW with the error shown.

Read these before relying on it.

• Conflation cannot tell a hallucination from a legitimate new package that blends common words. That is why it only counts alongside weak reputation.
• The known-hallucination corpus is small on purpose. It holds only names with a citable public source, because a guessed entry produces a confident, wrong BLOCK.
• PyPI download statistics are supplemental. When pypistats.org is slow or down, PyPI decisions fall back to reputation signals.
• It does not read package contents. It is one layer of defense, not a supply-chain security program.

For a hosted check that also carries a growing record of the names models keep inventing, see HALLUX, which folds pkgguard in.

Questions worth asking.