Stop Letting AI
Backdoor Your Stack.
// One hallucinated package can end careers.
// We make sure it doesn't.
For devs who live dangerously but like to know about it.
Start for FreeFor professional devs and small teams who ship fast and need guardrails.
For security teams, compliance-driven orgs, and large engineering departments.
Contact SalesRoast Engine
Paste any code snippet or manifest → get an instant security roast with severity scores, explanation of what went wrong, and a shareable horror report you can send to your team.
- ▸ Slopsquat detection
- ▸ Typosquatting patterns
- ▸ Homoglyph substitution (Pro)
- ▸ Phantom package identification
- ▸ AI hallucination confidence score
- ▸ Shareable roast permalink
GitHub PR Bot
Install once on your GitHub org. Every PR that touches a manifest file gets an automated DevHorrors review — blocked if critical threats found, commented with details if medium/high.
- ▸ Auto-review on every PR
- ▸ Block merge on critical threats
- ▸ Inline PR comments with threat details
- ▸ Slack/Discord notifications
- ▸ Custom severity thresholds
- ▸ Audit log for compliance
CI/CD Integration
Exorcist+Drop our GitHub Actions step into any pipeline. Works with GitLab CI, CircleCI, and Jenkins too. Set your failure threshold and let the bot handle the rest.
# .github/workflows/devhorrors.yml
name: DevHorrors Security Scan
on: [pull_request]
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run DevHorrors Scan
uses: devhorrors/scan-action@v2
with:
api-key: ${{ secrets.DEVHORRORS_API_KEY }}
fail-on: high
manifest: package.json
slack-webhook: ${{ secrets.SLACK_WEBHOOK }}Beyond Slopsquatting
Detect injected malicious code in otherwise legitimate packages that have been compromised post-publish.
Catch packages using lookalike Unicode characters — e.g. 'ехpress' with Cyrillic 'е' instead of Latin.
Identify internal package names that could be hijacked via public registry shadowing attacks.
Flag GPL, AGPL, or SSPL licenses that could create legal obligations in your commercial codebase.
Verify your package-lock.json and yarn.lock haven't been tampered with between commits.
Cross-reference every dependency against the NVD and OSV databases in real time.
Need a custom enterprise deal?
Volume pricing, custom integrations, on-prem deployment, and dedicated support.
Talk to Sales