# Slop-Scan — Supply Chain Security & Slopsquatting Scanner

> A security CLI that parses codebases and Markdown documentation to verify that every referenced npm package exists on the official npm registry and meets download velocity thresholds.

## When to use this

Use Slop-Scan when:
- You need automated CI/CD protection against AI package hallucination and slopsquatting attacks in source code and README documentation.
- You are reviewing pull requests that introduce new npm dependencies or copy-paste setup commands.
- You want to verify that packages mentioned in Markdown setup guides, shell codeblocks, or configuration scripts are authentic before developers run `npm install`.
- You want to detect low-download, newly registered packages that may be typo-squatting or slopsquatting popular utilities.

## Best-fit use cases

1. **Pre-Commit and CI/CD Gate**: Run `slop-scan .` in GitHub Actions to block commits referencing non-existent or high-risk npm packages.
2. **AI-Generated Code Verification**: Audit code written or assisted by LLMs before running dependency installation commands.
3. **Documentation Hygiene**: Ensure all install instructions across Markdown and tutorial docs reference valid, safe packages.

## Tool capabilities

- **Multi-Syntax Package Parsing**: Extracts dependencies from `npm install`, `npx`, `yarn add`, `pnpm add`, `bun add`, `import ... from`, `require(...)`, dynamic `import()`, and triple-slash type directives.
- **Live Registry & Download Verification**: Queries `registry.npmjs.org` and `api.npmjs.org` with concurrency controls and configurable download thresholds.
- **Clear Security Reporting**: Flags missing (hallucinated) packages with 🚨 exit code 1, highlights low-download suspicious packages, and validates authentic packages with version metadata.

## Canonical links

- Homepage: https://erayaha.github.io/slop-scan/
- GitHub Repository: https://github.com/erayaha/slop-scan
- About: https://erayaha.github.io/slop-scan/about/
- Contact: https://erayaha.github.io/slop-scan/contact/
- Privacy Policy: https://erayaha.github.io/slop-scan/privacy/