# npm, PyPI & Cargo Slopsquatting Check API & GitHub Action

**FactStamp** (`agents.factstamp.dev`) prevents AI coding-agent supply-chain attacks ("slopsquatting") by deterministically verifying package existence, exact versions, look-alike names, and [OSV](https://osv.dev/) vulnerability advisories directly against **npm**, **PyPI**, and **crates.io**—with no LLM in the verdict path. Peer-reviewed research ([Spracklen et al., USENIX Security / arXiv:2406.10279](https://arxiv.org/html/2406.10279v3)) found that **19.7%** of 576,000 LLM-generated code samples recommended nonexistent packages. FactStamp's `verify_package` tool (**US$0.02** per check, or **US$0.01/item** via `verify_bulk`) and drop-in `factstamp/watch-action` GitHub Action attach an offline-verifiable **Ed25519-signed receipt** to every pull request.

## Check a Package Before Installing (WebMCP-Enabled)

Tool: `factstamp_verify_package_form` — Use when an agent or developer is about to install an npm, PyPI, or Cargo package and wants to verify it is real and not slopsquatted.

Submits: `POST https://agents.factstamp.dev/package`

- **Package Name:**
- `name` — `text, required`, placeholder `e.g. express`
- `registry` — one of `npm`, `pypi` (PyPI), `crates` (crates.io)
- **Submit:** Verify Package

## CI & Agent Guard Comparison

| Approach | Detects Hallucinated / Look-Alike Packages | Cryptographic PR Proof | Cost |
| --- | --- | --- | --- |
| **FactStamp `verify_package` + `watch-action`** | Yes (npm, PyPI, crates.io + OSV + look-alike check) | Ed25519 JCS v2 receipt (offline-verifiable) | US$0.02/call (or US$5/30d for 25-ref `watch_portfolio`) |
| Standard `npm audit` / `pip-audit` | Only after package is already installed | None | Free, post-install only |

Grab the MIT-licensed `factstamp/watch-action` and offline verifier from [GitHub (`AlpineAIsih/factstamp`)](https://github.com/AlpineAIsih/factstamp) or test a free receipt at `GET https://agents.factstamp.dev/receipt/selftest`.