slopwatch v0.1.0
Detect slopsquatting attacks — AI-hallucinated packages registered by attackers in your npm and PyPI dependencies.
Features
- Statistical trust scoring (0-100) based on package metadata — no dictionary of known-bad names
- Supports
package.json,requirements.txt,pyproject.toml - Output formats: terminal (colored), JSON, SARIF
- GitHub Action with automatic SARIF upload to Security tab
- Pre-built binaries for Linux, macOS (Intel + Apple Silicon), Windows
Usage as GitHub Action
- uses: loicguillois/slopwatch@v0.1.0
with:
path: "."
format: "sarif"