The latest articles on DEV Community by Mary Oh (@mroh_314159). https://dev.to/mroh_314159 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4064348%2F23bc27bb-a481-475d-b29b-eeb103499cd5.png https://dev.to/mroh_314159 en Mary Oh Wed, 05 Aug 2026 20:18:38 +0000 https://dev.to/mroh_314159/hey-folks-sharing-something-ive-been-working-on-4b9m https://dev.to/mroh_314159/hey-folks-sharing-something-ive-been-working-on-4b9m <p>Like a lot of devs lately, I've been seeing more cases of "slopsquatting": AI coding assistants confidently suggesting package names that look real but don't exist, which then get registered by bad actors. A few have already made it into production package.json/requirements.txt files.</p> <p>So I built DevHorrors, a free scanner that checks your manifest (npm, PyPI, Go, RubyGems) against a curated database of known hallucinated, typosquatted, and malicious packages. It also has a "Roast Engine" that gives you a (darkly humorous) security critique of your dependencies, alongside the actual remediation steps.</p> <p>What it does:</p> <ul> <li>Paste/upload a manifest or repo → instant risk report per dependency</li> <li>Hallucination-confidence scores and the legitimate package to swap to</li> <li>A public threat feed + community "horror stories" from devs who got hit</li> <li>Free API + CLI for CI/CD</li> </ul> <p>It's free to use; there's a paid tier for team monitoring, Slack/Discord alerts, and GitHub PR blocking. I'm genuinely curious how others are handling this — is anyone here actively checking for AI-hallucinated packages in their pipelines, or relying on registries to catch it?</p> <p>Site: devhorrors.com · would love honest feedback, especially on what's missing for your stack.</p> <p>Thanks! Have a good day!</p> ai security Mary Oh Wed, 05 Aug 2026 13:28:37 +0000 https://dev.to/mroh_314159/hello-world-2506 https://dev.to/mroh_314159/hello-world-2506