npm, PyPI & Cargo Slopsquatting Check API & GitHub Action
FactStamp (agents.factstamp.dev) prevents AI coding-agent supply-chain attacks ("slopsquatting") by deterministically verifying package existence, exact versions, look-alike names, and OSV vulnerability advisories directly against npm, PyPI, and crates.io—with no LLM in the verdict path. Peer-reviewed research (Spracklen et al., USENIX Security / arXiv:2406.10279) found that 19.7% of 576,000 LLM-generated code samples recommended nonexistent packages. FactStamp's verify_package tool (US$0.02 per check, or US$0.01/item via verify_bulk) and drop-in factstamp/watch-action GitHub Action attach an offline-verifiable Ed25519-signed receipt to every pull request.
Check a Package Before Installing (WebMCP-Enabled)
CI & Agent Guard Comparison
| Approach | Detects Hallucinated / Look-Alike Packages | Cryptographic PR Proof | Cost |
|---|---|---|---|
FactStamp verify_package + watch-action |
Yes (npm, PyPI, crates.io + OSV + look-alike check) | Ed25519 JCS v2 receipt (offline-verifiable) | US$0.02/call (or US$5/30d for 25-ref watch_portfolio) |
Standard npm audit / pip-audit |
Only after package is already installed | None | Free, post-install only |
Grab the MIT-licensed factstamp/watch-action and offline verifier from GitHub (`AlpineAIsih/factstamp`) or test a free receipt at GET https://agents.factstamp.dev/receipt/selftest.