Slop-Scan
Supply Chain Defense

Slop-Scan Supply Chain Security

Protect your codebase from AI hallucinations and slopsquatting attacks. Slop-Scan crawls code and Markdown documentation to verify that every referenced npm package exists on the official registry and meets safe download thresholds.

⚡ Quick Start — Run in Your Pipeline

Scan your repository locally or in GitHub Actions before developers run installation commands:

# Scan current directory
npx slop-scan .

# Enforce higher weekly download threshold (e.g. 1,000 downloads)
npx slop-scan . --threshold 1000

🔍 In-Browser Live Package Verifier

Enter npm package names (or paste installation command snippets) to check live against the npm registry:

🛡️ Supported Syntaxes

  • npm install <pkg>, npm i, npm add
  • npx <pkg>, yarn add, pnpm add/install
  • bun add, bun install, bun i
  • import ... from '<pkg>', require('<pkg>')
  • Markdown code blocks (bash, sh, js, ts)

🤖 AI & Agent Discovery

Slop-Scan exposes standard Model Context Protocol (MCP) server endpoints and machine-readable instructions: