1 in 5 AI-Suggested Packages Doesn't Exist — I Built a Scanner for That

Description and use

Pre‑install dependency check: phantom‑deps identifies non‑existent and newly registered packages suggested by LLMs, reducing the risk of installing hallucinated dependencies.

Problem

AI coding assistants often suggest package names that do not exist or are newly registered, leading to potential security risks when users install them.

Outcome

phantom-deps provides a zero‑dependency, pre‑install check that identifies non‑existent or newly registered packages, reducing the risk of installing hallucinated or slopsquatted dependencies.

Workflow

• Generate code and requirements.txt with an AI assistant
• Run phantom-deps against requirements.txt, pyproject.toml, setup.cfg, package.json, and bare imports
• phantom-deps queries PyPI and npm registries for each third‑party name
• It flags PHANTOM (non‑existent) and NEW (published <30 days) packages
• If any flags are found, phantom-deps exits with code 1, stopping the install or CI step
• Review flagged packages and adjust the dependency list before proceeding

Evidence

19.7% pointed to packages that were never published

Source

phantom-deps is aimed at a different moment: "the LLM just recommended this — verify before installing."

Source

Exit code is 1 when anything is found, so it drops straight into CI or a pre‑commit hook

Source