npm Dependency & Slopsquatting Scan · $49 · 24 hours · Coming soon
Check every package your AI coding tool added.
AI coding tools sometimes suggest packages that don't exist (and can be registered by attackers), are typo-squats of real ones, or have known vulnerabilities. I scan your package.json and lockfile and review the results by hand, so you get the few that matter rather than a wall of warnings.
npm Dependency & Slopsquatting Scan is a fixed-price service from ChikuOS, run by Siddharth Mishra, an independent developer in India. Did your AI tool install a fake, abandoned or vulnerable package? A dependency scan in 24 hours. It is planned at $49 with a turnaround of 24 hours, but it isn't available to buy yet.
Coming soon Follow @SidShipsAI
What you get
- npm audit and Semgrep supply-chain results, reviewed and de-duplicated by hand
- Suspicious-package check: very new, low-download, typo-similar or recently transferred packages, and install scripts
- Abandoned or deprecated dependencies, with maintained alternatives
- A ranked list: what to remove, upgrade or replace, with exact commands
- Delivered as a PDF within 24 hours
Read-only. I need only package.json and the lockfile (or a repo link), and I never run your code. This reduces risk but can't prove a package is safe.
Timeline
- Send package.json and lockfile (or repo link)
- Automated scans reviewed by hand
- Ranked PDF with exact commands within 24 hours
Who it's for
- JavaScript apps where an AI tool added packages
- Founders worried about fake, typo-squatted or abandoned packages
- Teams who want a short, ranked list instead of a wall of warnings
FAQ
Do you run my code?
No. It's read-only; I only need package.json and the lockfile.
Does it prove packages are safe?
No. It reduces risk but can't prove a package is safe.
What tools do you use?
npm audit and Semgrep supply-chain results, plus a manual review.