Check a package exists before you install it

AI assistants invent package names. Attackers register them (slopsquatting).

npm

copy and paste

npm view <name> time.created maintainers repository --json

copy and paste

pip index versions <name>
curl -s https://pypi.org/pypi/<name>/json | jq '.info.project_urls, .releases | keys | .[0]'

Created days ago, one maintainer, no repository, a postinstall script, a name one letter off a famous package.

copy and paste

npm install <name> --ignore-scripts

A new disaster and its fix every day. Comment the word under a reel to get its guide.