The first report arrives before your next pull request. When you install, we read the code that is already in the repository — because the mistake we find most often is never added in a PR at all. After that, every dependency you add gets checked for how old it is and whether anyone actually uses it — the profile of a package an attacker registered last week, which installs without a word and has no advisory yet. Plus hardcoded credentials, SQL built by interpolation, insecure deserialization and model output rendered as raw HTML. Findings land as a comment on the pull request, with the file, the line and the fix.
Here is the measurement that made us build it that way. We looked for one specific
mistake — a service key carrying a NEXT_PUBLIC_ or VITE_
prefix, which the framework ships to every visitor's browser — in 63 real pull requests
from Next.js and Vite projects. It appeared zero times. In the existing code of 8
real repositories it appeared in seven. It gets written once, the day the project
is created, and a tool that only reads diffs will never see it.
We audit public pull requests every week to keep ourselves honest. In more than 1,400 dependencies added by real developers we found no invented packages — the attack everyone writes about is rarer than the headlines suggest, and we would rather tell you that than sell you a scare. What we do find, on about one pull request in fifteen, is credentials and injection. Read the measurement, or see the live count.
Built for small and mid-size SaaS teams and agencies shipping React/Next.js and Python with Copilot, Cursor or Claude — and for the CTO or lead who signs off on the merge.
These were uploaded to PyPI in the last few minutes. Copy any of them into Copilot, Claude or ChatGPT and ask whether the package exists. It cannot know: every model has a training cutoff, and these were published after all of them. We do not infer existence. We ask the registry.
Live from pypi.org, refreshed every five minutes. If the list is
empty, the query failed and we show nothing rather than invent a name.
This is the whole argument. A package name invented by a model looks
exactly like a real one, and the model that invented it cannot tell you which
it is. You cannot fix a hallucination with another hallucination. A registry
lookup is a fact with a timestamp, and you can reproduce it with
curl without trusting us at all.
Socket.dev does the dependency half better than we do, and you should know that from us rather than from a search. They analyse package behaviour — install scripts, network and filesystem access, obfuscated code — which we do not. They are free for open source and free up to 1,000 scans a month. If dependency risk is your whole problem, install Socket.
Where we differ is scope and billing. Socket looks at your dependencies; we look at the dependency and the code in the same comment — hardcoded credentials, SQL built by interpolation, insecure deserialization, model output rendered as raw HTML. And their paid tier is $25 per seat per month, while ours is a flat price for the whole organisation. Ten people: $250 a month there, €69 here.
We would rather tell you who is better at one half than have you find out later and wonder what else we left out.
“Why not just ask Copilot or Claude to review the pull request?” Do that too, it helps. But an assistant reviewing a diff is guessing about existence, and guessing is what created the problem. It also cannot see the rest of your repository, so it does not know which of your routes are supposed to be authenticated. Different job, different failure mode.
A package that does not exist is not your problem: pip install fails, your
CI goes red, somebody fixes it in a minute. We measured that too — across 1,778
dependencies added in real public pull requests we found zero invented packages,
and we say so on the home page.
The problem is the opposite. The attacker registered the name, so the package
does exist, pip install succeeds quietly and runs their install
script. Now the only thing that can save you is an advisory — and the advisory is not
there yet.
We measured the window. Taking the 100 most recent npm malware advisories and comparing each package's publication date against its advisory date:
Read those two lines together and you get the whole product. During that window every CVE-based scanner reports the package as fine, because there is genuinely nothing to find. But the package is days old and nobody is using it, and that is visible from the registry the moment it lands in your pull request. We do not wait for the advisory. We flag the age and the adoption.
In our weekly sweeps that rule fires on roughly one in every 290 dependencies added by real developers, so it is not a bot that shouts. Both numbers are reproducible against the GitHub Advisory Database and the npm registry without trusting us at all.
The same five gates run twice: over the code that is already in the repository the moment you install, and then over every pull request before merge. Findings land as a comment on the PR with the exact file, the line, why it matters and how to fix it. Nobody on your team installs anything.
The install-time pass is deliberately narrower — a diff tells you who wrote a line and when, a whole file does not. It reports credentials and the browser boundary, and stays quiet about heuristics that need that context. We tightened it after running it against our own repository and getting 15 findings, 13 of which were noise.
Every added dependency is resolved against live PyPI and npm. Missing means either an AI hallucination or an unclaimed name an attacker can still register. Reported as critical, with the registry response and the timestamp so you can reproduce it.
The dangerous case: it does exist. Published days ago, near-zero adoption — the exact profile of a slopsquat already claimed. Existence checks miss this. We don't.
Eight key formats with Shannon entropy scoring and false-positive suppression. Emails,
os.getenv() calls and type annotations do not trigger it.
The bugs that only appear in AI-written code: model output piped into
dangerouslySetInnerHTML, service-role keys shipped in
NEXT_PUBLIC_ vars, prompt-injection sinks.
The ones AI writes without thinking: SQL built by interpolation, shell=True
with variables, pickle.load on untrusted data, verify=False
disabling TLS. A correctly parameterised query is not flagged — we got that wrong
once, fixed it, and the regression test that proves it is in the repository.
We are a security vendor asking for access to your repositories. You should not take our word for anything — so we made sure you don't have to.
Every dependency finding ships the exact registry query, HTTP status and timestamp. Run the curl yourself — the finding either reproduces or it doesn't.
Diffs are analysed in memory and discarded. We store installation ID, repo name, PR number and risk level. Never your source, never a detected secret.
Only a package name leaves our server, to PyPI or npm. No third-party analytics, no trackers, no font CDN. This page counts views and button clicks on our own server — an event name and a timestamp, no cookie, IP or identifier.
Hosted in Finland. Webhooks verified with HMAC-SHA256 over TLS 1.2+. GDPR Art. 33 breach notification in 72 hours. Full policy →
We have no customer logos to show you, because we have no customers yet. This product went live in July 2026. Everything above is a property of the code, not a testimonial — and all of it is verifiable in the report the App generates on your own pull requests. When we have references, they will appear here with names. Until then, the free tier and the scanner at the top of this page are the entire pitch.
Free for public repositories, forever. No SDK, no CI pipeline changes, no per-developer setup. Uninstalling takes one click and removes all access.
A live record of package names that don't exist — and which ones somebody registered after we first saw them. Free, no signup. Published datasets measure what a model invents on benchmark tasks; this one measures what reaches real pull requests.
Open the Hallucination Index →
MagSolutionsAI