Slopsquatting Python Packages

valvur

Offline security scanning for AI-generated code: seven open-source scanners and AI-specific checks in one command. It finds secrets, vulnerable, hallucinated and malicious dependencies, poisoned agent configuration, and infrastructure and code flaws. An MCP server for Claude Code and Kiro, and a CLI. Your source never leaves your machine.

vdb-mcp

MCP server for VDB — check packages, MCP servers and AI models for CVEs and slopsquatting before your agent installs them

ghostpkg

Catch AI-hallucinated package names before you install them

deployproof

Deterministic pre-push verification for AI-assisted codebases: AST mutation testing, credential scanning, sandbox-escape detection, mock-usage alerts, and dependency hallucination defense.

phantomdep

Catches hallucinated package dependencies before they hit your codebase. Sub-10s polyglot scan.

pkgguard-cli

Vet the packages & repos your AI assistant recommended — before you install. Catches hallucinated/slopsquatted names, CVEs, malware, fake stars, and license traps in 25 languages. MCP server so the assistant checks itself. No API key.

vaporcheck

Stops AI coding assistants from using packages, files, and functions that don't exist. A safety net against hallucinated and slop-squatted names.