Deploy

Check every package your AI added

AI tools sometimes suggest packages that don't exist or are typos. Attackers register those names. How to verify packages, lock versions and audit.

Why it matters

Models sometimes suggest packages that don't exist, or near-miss spellings of real ones. Attackers register those names with malicious install scripts. This is called slopsquatting.

How to fix it

1. For each new dependency, look it up on npmjs.com or pypi.org: exact name, linked source repository, recent releases, reasonable downloads.
2. Remove packages you don't need; every dependency is code you trust.
3. Commit your lockfile and install with npm ci (or your package manager's frozen-lockfile option) in CI.
4. Run npm audit or a similar tool and fix high-severity issues.

npm view some-package name repository.url time.modified
npm ci
npm audit --omit=dev

How to verify

• Every dependency in package.json is one you recognise and checked.
• CI installs from the lockfile.

Questions

Does npm audit catch slopsquatting?

Not reliably. It reports known vulnerabilities; a new malicious package may have none yet. Check names by hand.

Related checks

• Turn on secret scanning
• Don't leave debug, admin or test routes public
• Treat user and AI input as untrusted

Tick it off in the full checklist