DEV Community

hao li
hao li

Posted on

1 in 5 AI-Suggested Packages Doesn't Exist — I Built a Scanner for That

#security #ai #python #supplychain

1 in 5 AI-Suggested Packages Doesn't Exist — I Built a Scanner for That

You ask an AI coding assistant for help. It writes the code and the
requirements.txt. You pip install -r requirements.txt. And one of those
package names? The AI made it up.

Research presented at USENIX Security 2025 measured this at scale: across
2.23 million package references produced by 16 large language models,
19.7% pointed to packages that were never published. Attackers know this
too — they register those plausible-sounding names first, and the next person
who installs the AI's suggestion runs their code. The industry name for it is
slopsquatting.

I wanted a 30-second check between "the AI gave me code" and "I installed its
dependencies". So I built phantom-deps:

  • Scans requirements.txt, pyproject.toml, setup.cfg, package.json, and bare Python imports in your project
  • Checks every third-party name against the real PyPI / npm registries
  • Flags two things:
    • PHANTOM — the package doesn't exist at all (the hallucination case)
    • NEW — the package exists but was first published < 30 days ago (the slopsquatting / typosquat window) 
pip install phantom-deps
phantom-deps ./my-ai-generated-project
Enter fullscreen mode Exit fullscreen mode 
PHANTOM — does not exist on the registry (1):
  ✗ datavalidator-pro [pypi, from requirements.txt]

NEW — published recently, high risk (1):
  ! fastjson-utils (6d old) [pypi, from imports]

1 known-good packages checked, 3 total.
Enter fullscreen mode Exit fullscreen mode

Exit code is 1 when anything is found, so it drops straight into CI or a
pre-commit hook:

phantom-deps . || echo "unverified dependencies — review before installing"
Enter fullscreen mode Exit fullscreen mode

Why another scanner?

The slopsquatting space already has players, but they mostly watch registries
for malicious uploads or audit lockfiles you've already committed.
phantom-deps is aimed at a different moment: "the LLM just recommended
this — verify before installing."

  1. Pre-install, not post-hoc. It runs on the AI-generated snippet's requirements.txt / import block before anything touches your environment.
  2. Nonexistence is the primary signal. For AI-generated code the base rate is different — ~1 in 5 suggested packages was never published at all — so "does this exist?" is the cheapest, highest-value question.
  3. Zero dependencies, instant. Python standard library only (urllib talks to the PyPI JSON API and the npm registry directly). No daemon, no account, no SBOM pipeline. Registry results are cached locally.

Bare imports get a best-effort mapping to distribution names (bs4 →
beautifulsoup4, PIL → Pillow, cv2 → opencv-python, …). Every mapped
name is still verified against the real registry, so a wrong guess only costs
an extra lookup — it can never produce a wrong verdict. And it fails open on
network errors: an unreachable registry is reported as a note, never as a
false "phantom".

Links

MIT licensed. If it catches one hallucinated pip install for you, it paid
for itself.

Top comments (0)