We Track What
AI Gets Wrong.
// DevHorrors is the definitive community encyclopedia
// for AI-hallucinated, slopsquatted, and typosquatted packages.
// Built by devs. For devs. Against the machines.
Defend every npm install from AI slop.
LLMs like ChatGPT, Claude, and GitHub Copilot hallucinate package names every day. When developers blindly install those suggestions, real malware gets executed — credentials stolen, pipelines hijacked, companies breached.
DevHorrors exists to close that gap. We maintain a continuously updated encyclopedia of hallucinated packages, run community-sourced horror stories as threat intelligence, and provide developer tooling to catch these threats before they ship.
We believe in open knowledge: the encyclopedia is free. The scanner is free. The community is free. Advanced CI/CD protection and enterprise features fund the mission.
The first public database of AI-hallucinated package names, continuously maintained by security researchers and developers worldwide.
Our threat feed aggregates community reports, automated scanning, and researcher submissions into a single live feed.
Free scanner, GitHub Actions integration, and CI/CD scripts. Enterprise features fund free tiers for individual developers.
Spectre 👻
Spectre wasn't always a ghost. Once, Spectre was a perfectly ordinary npm package — react-fast-render — dreamed up by a large language model late one Tuesday night. The model had never seen the package, couldn't cite a repository, and didn't know it didn't exist. It just sounded right.
A tired developer, three coffees deep, ran npm install. The package wasn't on the registry — but someone had registered it the week before, knowing an AI would eventually recommend it. The install script ran silently. Credentials leaked. Pipelines broke. Spectre was born in the blast.
Now Spectre haunts the DevHorrors encyclopedia, drifting through node_modules and site-packages everywhere, leaving behind a cold trail of warnings. The mascot is a reminder: the most dangerous threats are the ones you can't see — the packages that sound real, look real, even work real, but were never there at all.
"I am the ghost of every package that never existed. Boo." — Spectre
Partnerships & Sponsorships
DevHorrors reaches security-conscious developers, DevSecOps engineers, and engineering leaders at every level — from solo devs to Fortune 500 teams. If your product belongs in front of that audience, let's talk.
Content Sponsorship
Feature your security tool, developer platform, or service in our weekly threat digest and email newsletter. Reach 10,000+ security-aware developers who actively monitor threats.
Sponsor a NewsletterTechnology Partnership
Integrate DevHorrors threat data into your SIEM, DAST, or developer security platform. We offer a partner API tier with full encyclopedia access, webhook events, and co-marketing.
Become a PartnerResearch Collaboration
Academic institutions, security labs, and threat intelligence firms: collaborate on our dataset. Joint publications, shared research credits, and access to our anonymised scan telemetry.
Research InquiryContact Us
Whether you're interested in enterprise security, a partnership, sponsoring our newsletter, or just want to say hello — we read every message.
Enterprise & partnership inquiries: 24h
General & press: 48–72h