1 in 5 AI-Suggested Packages Doesn't Exist — I Built a Scanner for That

Описание и применение

Проверка зависимостей перед установкой: инструмент phantom‑deps обнаруживает несуществующие и недавно зарегистрированные пакеты, рекомендованные LLM, снижая риск установки «галлюцинаторных» зависимостей.

Задача

AI coding assistants often suggest package names that do not exist or are newly registered, leading to potential security risks when users install them.

Результат

phantom-deps provides a zero‑dependency, pre‑install check that identifies non‑existent or newly registered packages, reducing the risk of installing hallucinated or slopsquatted dependencies.

Рабочий процесс

• Generate code and requirements.txt with an AI assistant
• Run phantom-deps against requirements.txt, pyproject.toml, setup.cfg, package.json, and bare imports
• phantom-deps queries PyPI and npm registries for each third‑party name
• It flags PHANTOM (non‑existent) and NEW (published <30 days) packages
• If any flags are found, phantom-deps exits with code 1, stopping the install or CI step
• Review flagged packages and adjust the dependency list before proceeding

Доказательства

19.7% pointed to packages that were never published

Источник

phantom-deps is aimed at a different moment: "the LLM just recommended this — verify before installing."

Источник

Exit code is 1 when anything is found, so it drops straight into CI or a pre‑commit hook

Источник