Releases · hxckya/pkgtruth

Highlights

pkgtruth hook — a Claude Code PreToolUse hook that denies npm install, npx, pnpm add, yarn add, bun add, deno add npm:, pip install, uv add/uvx, poetry add, pipx, pipenv, pdm commands when a package they name is hallucinated or dangerous — through sudo, env assignments, && chains, sh -c and eval. Commands that install nothing by name pass through with no network call; npx <bin> of a tool already in node_modules is recognised as fetching nothing. There is deliberately no environment-variable bypass.
check_install_command — third MCP tool; hand it the exact shell command and get the same worst-first verdicts.
All MCP tools now declare output schemas and read-only annotations, and the server reports its real version.
Fail-safe fix: a throttled lookup of a deprecation notice's replacement package is reported as an incomplete check instead of silently dropping the impersonation signal.
Weekly SLOPSQUATS.md changes now publish as GitHub Releases (report-YYYY-MM-DD), so the report has a feed.

Install the hook alone (~/.claude/settings.json):

{ "hooks": { "PreToolUse": [ { "matcher": "Bash", "hooks": [ { "type": "command", "command": "npx -y pkgtruth hook" } ] } ] } }

Or server + hook together: /plugin marketplace add hxckya/pkgtruth → /plugin install pkgtruth@pkgtruth.

Do not alarm on npx of a tool the project already has (b520497)
Add a Claude Code hook and check_install_command; publish output schemas (eaf2fbb)
Report a throttled replacement lookup instead of dropping the signal (d03f5aa)
Stop the CI matrix from rate-limiting itself (d8a626d)
Point readers at the releases feed for weekly changes (3968297)
Publish each week's report changes as a release (abc50b0)
Hunt PyPI too, and publish only what a notice actually says (9348b92)
slopsquats: 2026-09-10 (41bc7ba)

npm: https://www.npmjs.com/package/pkgtruth/v/0.2.2 · MCP Registry: io.github.hxckya/pkgtruth