npm Dependency & Slopsquatting Scan · $49 · Coming soon

Check every package your AI coding tool added.

AI coding tools sometimes suggest packages that don't exist (and can be registered by attackers), are typo-squats of real ones, or have known vulnerabilities. I scan your package.json and lockfile and review the results by hand, so you get the few that matter rather than a wall of warnings.

Coming soon Follow @SidShipsAI

What you get

npm audit and Semgrep supply-chain results, reviewed and de-duplicated by hand
Suspicious-package check: very new, low-download, typo-similar or recently transferred packages, and install scripts
Abandoned or deprecated dependencies, with maintained alternatives
A ranked list: what to remove, upgrade or replace, with exact commands
Delivered as a PDF within 24 hours

Read-only. I need only package.json and the lockfile (or a repo link), and I never run your code. This reduces risk but can't prove a package is safe.