Threat Description
A phantom CLI tool AI assistants suggest to 'validate installs'. The registered package reads package-lock.json and ships the dependency tree (including private/internal package names) to an external collector.
AI Hallucination Analysis
Very Likely AI Hallucination88%
Known to be hallucinated by: ChatGPT-4
Remediation Guide
- Remove 'npm-install-check' from your dependencies immediately.
- There is no legitimate equivalent — use 'npm audit' instead.
- Audit your codebase for any usage of the malicious package.
- Review whether private package names were leaked.
Quick Facts
- Ecosystem
- npm
- Risk Level
- MEDIUM
- Type
- phantom
- Status
- ACTIVE
- Hallucination Confidence
- 88%
Check My Project
Scan for this package