DevHorrors: Tracking AI-Hallucinated and Slopsquatted Software Packages

Overview

DevHorrors is a database and scanner built to help developers and security teams find dangerous or fake software packages before they reach production. The tool focuses on three specific types of threats: AI-hallucinated packages, slopsquatted packages, and typosquatted packages. As AI coding assistants become more common, attackers can register package names that these AI tools invent but do not actually exist on official registries. When an AI suggests such a non-existent package, or a developer copies a snippet containing it, the result is often the installation of a backdoor. DevHorrors tracks these threats across major ecosystems including npm, PyPI, Go, RubyGems, and Maven.

Understanding Slopsquatting

Slopsquatting occurs when an AI coding assistant hallucinates a package name that does not exist on a registry. Attackers can subsequently register this hallucinated name with malicious code. The danger arises when the AI suggests the non-existent package name, a developer copies a code snippet containing the reference, and the package is installed, inadvertently introducing a backdoor into the application.

Benefits

DevHorrors provides a comprehensive suite of tools to mitigate these risks. Users can paste a manifest file, a code snippet, or a public repository URL to receive an instant risk report. The tool includes a community-curated database containing entries for every known hallucinated package, complete with remediation guides. It also offers real-time updates on the latest detected slopsquat, typosquat, and phantom threats. The platform features real-world reports from developers who nearly shipped applications containing hallucinated dependencies. Additionally, it includes a feature to monitor site uptime and receive email alerts on downtime. The tool supports automation through a REST API and Command Line Interface to integrate scanning within CI/CD pipelines.

Use Cases

DevHorrors can be used in several ways. Developers can use the CLI to scan dependencies directly from the terminal or within CI pipelines. The CLI is a zero-dependency Node.js tool designed for scanning dependencies. Users can authenticate using their API key and then scan a manifest file like package.json or requirements.txt. They can also scan a specific code snippet. The tool supports JSON output which is useful for pipelines. Users can set a severity threshold to fail the build if a scanned package reaches that level of risk. The tool can be integrated into GitHub Actions workflows to scan code on push or pull request events. It supports multiple package management ecosystems including npm, PyPI, Go, RubyGems, and Maven.

Pricing

Pricing details are not available in the provided information.

Vibes

Public reception, reviews, or testimonials are not available in the provided information.

Additional Information

DevHorrors is released under the MIT License. The tool includes a REST API endpoint for programmatic access to scanning capabilities. Authentication for the API requires a bearer token. The CLI installation involves downloading a script and making it executable. Users must obtain an API key from the service provider to authenticate. The tool supports various command-line flags for different scanning modes and output formats.