1 in 5 AI-Suggested Packages Doesn't Exist — I Built a Scanner for That

说明与用途

预安装依赖检查：phantom‑deps 识别 LLM 建议的不存在或新注册的包，降低安装幻觉依赖的风险。

问题

AI coding assistants often suggest package names that do not exist or are newly registered, leading to potential security risks when users install them.

结果

phantom-deps provides a zero‑dependency, pre‑install check that identifies non‑existent or newly registered packages, reducing the risk of installing hallucinated or slopsquatted dependencies.

工作流

• Generate code and requirements.txt with an AI assistant
• Run phantom-deps against requirements.txt, pyproject.toml, setup.cfg, package.json, and bare imports
• phantom-deps queries PyPI and npm registries for each third‑party name
• It flags PHANTOM (non‑existent) and NEW (published <30 days) packages
• If any flags are found, phantom-deps exits with code 1, stopping the install or CI step
• Review flagged packages and adjust the dependency list before proceeding

证据

19.7% pointed to packages that were never published

来源

phantom-deps is aimed at a different moment: "the LLM just recommended this — verify before installing."

来源

Exit code is 1 when anything is found, so it drops straight into CI or a pre‑commit hook

来源