Check that a package exists before your AI agent installs it

A developer built Package Safety Checker, a RapidAPI-hosted endpoint that queries npm, PyPI, crates.io, Go, Maven and NuGet registries to verify whether a package exists before an AI agent installs it, returning a verdict of ok, caution or not-found along with age, download counts, licences and known advisories. The tool targets "slopsquatting", in which attackers register the plausible-sounding package names that coding assistants invent and wait for an install command to run. The developer recommends agents refuse not-found verdicts and surface caution reasons to a human, while noting the check is screening rather than a guarantee and that version pinning and lockfiles remain necessary.

AI coding assistants are good at writing code and surprisingly confident about package names. Every so often they suggest one that does not exist. Attackers have noticed: they register the names models tend to invent and wait for someone to run the install command. The practice now has a name, "slopsquatting", next to the older typosquatting. If an agent in your workflow runs npm install or pip install on its own, one cheap check closes most of that gap: before installing, ask the registry whether the package is real, how old it is, and whether anything is known to be wrong with it. For each package name an agent proposes: lodash from a lookalike. You can do all of this by hand against each registry's API. Each registry has its own format, which is where it gets tedious across npm, PyPI, crates.io, Go, Maven and NuGet. I wrapped those checks into one endpoint that returns the same shape for all six ecosystems: curl --request GET \ --url 'https://package-safety-checker.p.rapidapi.com/package?ecosystem=npm&name=lodash' \ --header 'x-rapidapi-host: package-safety-checker.p.rapidapi.com' \ --header 'x-rapidapi-key: YOUR KEY' The answer includes exists , the latest version and release date, age in days, version count, weekly downloads for npm, licences, deprecation, known advisories with severity, and a verdict of ok , caution or not-found with the reasons. A second endpoint checks up to 10 packages in one call, which fits the "agent wants to install these five things" case. In an agent, the rule is simple: if the verdict is not-found , refuse; if it is caution , show the reasons to a human before installing. The free tier covers 50 checks a month: Package Safety Checker on RapidAPI https://rapidapi.com/Splzzze/api/package-safety-checker . This is screening, not a guarantee. A package can be old, popular and advisory-free and still be compromised tomorrow. Pin versions, use lockfiles, and keep install scripts in mind. The check simply removes the most common and most embarrassing failure: installing something that should never have existed.