Skip to content

v3.22.0

Choose a tag to compare

View all tags
@goklab goklab released this 18 Jun 20:37
v3.22.0
19dc139

slopscan — AI-hallucinated / slopsquat package detector (38 → 39 tools).

New scan_hallucinated_packages MCP tool + slopscan [path] CLI:

  • Offline (deterministic, air-gapped): phantom imports (imported in source but in no package.json) + typosquats. Statement-anchored, comment/template-aware (0 false positives on example-heavy source).
  • Online (opt-in, graceful degrade): npm-registry truth — 404 = nonexistent, brand-new + low-download = slopsquat pattern.
  • full_audit gains a hallucinated-packages section (offline only → deterministic result hash preserved).

Catches the supply-chain seam commodity SCA misses: names that don't exist yet, were never installed, or were published yesterday — at code-gen/PR time. Reuses existing primitives; zero new runtime dependencies.

Assets 2
Loading