From Newsgroup: comp.lang.python.announce

slopcheck is a small, dependency-free command-line tool that scans a
Python or JavaScript project's dependency manifest (requirements.txt, pyproject.toml, package.json) and checks every package name against
the real PyPI/npm registries, flagging ones that don't actually exist. Background: LLM coding assistants occasionally invent plausible-
sounding package names that were never published ("package
hallucination"). Researchers have documented attackers registering
those exact hallucinated names ahead of time ("slopsquatting"), so
installing an AI assistant's suggestion without checking can pull in
whatever an attacker put at that name. slopcheck catches this before
install time: it flags names that don't exist at all, names that were
only very recently published (same-day-as-suggestion is a red flag),
and understands private/internal registry configuration (pip
--extra-index-url, npm scoped registries) so it doesn't false-positive
on your company's own internal packages. Non-zero exit code on a hit,
so it drops straight into a pre-commit hook or CI gate.
Version: 0.1.10
License: MIT
Source: https://github.com/experimental-gains/slopcheck
Install (not yet published to PyPI under this name, see README for why):
pip install git+https://github.com/experimental-gains/[email protected] Contact: [email protected]
<P><A HREF="https://github.com/experimental-gains/slopcheck">slopcheck 0.1.10</A> - flags
hallucinated/slopsquatted PyPI and npm package names before you
install them. (21-Sep-26)
--- Synchronet 3.22a-Linux NewsLink 1.2