Package Scanner
Paste your manifest file or upload it. We'll check every dependency against the SlopsquatDB.
Paste your manifest or source code. Our security ghost tears into your dependencies — then tells you exactly how to fix it.
- ✓ Known slopsquatted packages
- ✓ AI-hallucinated package names
- ✓ Typosquatting patterns
- ✓ Phantom packages
- ✓ Hallucination confidence scores
- ○ Real-time registry check (Pro)
Shared scan history, Slack alerts, GitHub Actions integration for your whole team.
Install once. DevHorrors automatically comments on PRs that introduce malicious dependencies, sets commit statuses, and breaks builds on critical threats — powered by both our encyclopedia and AI hallucination detection.
DevHorrors authenticates to GitHub through an authorized connector with repo and workflow scopes — no long-lived tokens or secrets to manage. The bot reads changed manifest files, runs the scan, then posts a PR comment and a commit status.