Skip to content

v0.1.0 — slopsquat and AI-hallucinated package detection

Latest
Latest

Choose a tag to compare

View all tags
@rxslice rxslice released this 05 Sep 14:45
· 8 commits to main since this release
v0.1.0
af5cc21

pkgguard v0.1.0 — first public release.

Verifies npm, PyPI and crates.io package names before install, to catch LLM-hallucinated dependencies and slopsquatting supply-chain attacks.

What it does

The core capability is conflation detection — identifying names that blend two real packages into a third that never existed:

jscodeshift + react-codemod  ->  react-codeshift

That name is 8+ edits from either parent, so edit-distance typosquat scanners score it as unrelated and let it through. It was registered on npm in January 2026 after appearing in LLM-generated agent skills.

An existence check alone does not help: by the time you look, the hallucinated name often does exist, because someone registered it. That is the entire attack.

Measured performance

Metric Result
False BLOCK on 200 real npm packages outside the popularity corpus 1.0%
Correctly ALLOWed 96.0%
Threat recall 7/7

Both documented real-world slopsquats (react-codeshift, unused-imports) score 100 and BLOCK.

How those numbers were reached

An early version of the conflation detector benchmarked at 0% false positives — against packages that were in the popularity corpus, which short-circuit the check. That test was meaningless.

Re-run against 800 real packages outside the corpus, the same detector flagged 62.5% of legitimate packages. Names like mock-redis-client and react-loading-hook are token blends too.

Two architectural fixes, not threshold tuning, brought it to 1.0%:

  1. Conflation is not a standalone signal. It is gated behind weak reputation and cannot reach BLOCK alone.
  2. Typosquat detection measures adoption ratio, not spelling. expres is 14 years old with a real repo and 22,468 monthly downloads — every age heuristic reads it as legitimate. But express has 529,873,075. Capturing 0.0042% of your namesake traffic is the signature.

Reproduce both numbers: python scripts/benchmark.py --sample 200

Included

CLI (install-command and manifest scanning, CI exit codes), FastAPI HTTP API, GitHub Action, 25 tests, corpus refresh and benchmark scripts. Zero required dependencies for the CLI.

License

Business Source License 1.1 — free for internal and CI use including at commercial companies. Commercial license required to resell, host, or embed. Converts to Apache 2.0 on 2030-09-05.

Built by Blvkware — https://blvkware.dev

Assets 2
Loading