Package name check

A coding agent writes an import line the same way it writes a sentence: by predicting what usually comes next. Most of the time the package it names is real. Sometimes it is not, and the name is a plausible invention that reads exactly like a package you would expect to exist. The code looks finished, the install step is the moment the invention shows up, and by then nobody is reading the output line by line.

The pattern has a name, slopsquatting, and it has been measured. A USENIX study of 2.23 million generated code samples found 19.7 percent of them referenced a package that did not exist, and the same invented names come back again and again, which is what makes them worth registering. In February 2026 a campaign of 126 malicious npm packages was published against exactly those names.

So the reason this matters is not the failed install. It is what happens when somebody publishes a package under the invented name first, which is cheap to run at scale. From then on the install succeeds, the build is green, and code you never read is running wherever your app runs, with whatever your app can reach.

This tool takes text rather than an address. Paste a dependencies block from your package.json, an install command, or one name per line. Every readable name is asked of the public registry once, and the result reports whether a package of that name is published, along with the exact request and the status code that came back.

A missing name is not proof of anything except that no package answers to it today. A published name is not proof that the package is safe, only that it exists. What this gives you is the shortest possible way to notice a name nobody has published, before an install command turns it into a decision somebody else gets to make.

This has already happened to other people. Read the incident.

This page is for running the check. The finding page explains the issue itself, and it is the page to read or link when you want the explanation rather than the test. Read the finding page.