Like a lot of devs lately, I've been seeing more cases of "slopsquatting": AI coding assistants confidently suggesting package names that look real but don't exist, which then get registered by bad actors. A few have already made it into production package.json/requirements.txt files.
So I built DevHorrors, a free scanner that checks your manifest (npm, PyPI, Go, RubyGems) against a curated database of known hallucinated, typosquatted, and malicious packages. It also has a "Roast Engine" that gives you a (darkly humorous) security critique of your dependencies, alongside the actual remediation steps.
What it does:
Paste/upload a manifest or repo → instant risk report per dependency
Hallucination-confidence scores and the legitimate package to swap to
