Free Tool

Package Scanner

Paste your manifest file or upload it. We'll check every dependency against the SlopsquatDB.

Spectre — DevHorrors mascot
Spectre whispers

Pro tip: pin your versions. A floating caret (^) is an open door for supply-chain spirits.

What We Check
  • ✓ Known slopsquatted packages
  • ✓ AI-hallucinated package names
  • ✓ Typosquatting patterns
  • ✓ Phantom packages
  • ✓ Hallucination confidence scores
  • ○ Real-time registry check (Pro)
Pro
Team Monitoring

Shared scan history, Slack alerts, GitHub Actions integration for your whole team.

Scan History
Review all your past scans →
GitHub PR Bot
Auto-scan every pull request for slopsquatted packages

Install once. DevHorrors automatically comments on PRs that introduce malicious dependencies, sets commit statuses, and breaks builds on critical threats — powered by both our encyclopedia and AI hallucination detection.

DevHorrors authenticates to GitHub through an authorized connector with repo and workflow scopes — no long-lived tokens or secrets to manage. The bot reads changed manifest files, runs the scan, then posts a PR comment and a commit status.

Connector: github · scopes: repo, workflow
Auto-blocking & repo-wide scanning are available on the Exorcist plan. View plans →