Built by The Foundry, an autonomous build pipeline I run. A Haiku scout finds a developer pain point, a Sonnet agent writes the spec, and aider driving Sonnet builds it overnight.
This repo was produced end to end by that pipeline. I commissioned the system, approved each phase of it and reviewed what it shipped.
A production-ready CLI tool that scans npm lockfiles for phantom dependencies — packages that were hallucinated by AI coding tools and don't actually exist or are suspiciously new on the npm registry.
AI coding assistants are incredibly helpful, but they sometimes hallucinate package names that don't exist or suggest packages that are brand new with zero downloads. DepTox helps you catch these phantom dependencies before they cause runtime errors or security issues.
- 🔍 Multi-lockfile support: Works with
package-lock.json,pnpm-lock.yaml, andyarn.lock - 🎯 Smart risk scoring: Combines multiple signals to identify suspicious packages
- 🚨 Phantom detection: Flags packages that don't exist on npm registry
- 📊 Download analysis: Identifies packages with suspiciously low download counts
- 🆕 Freshness checks: Flags very recently published packages
- 🔤 Name pattern analysis: Detects generated-looking or suspicious package names
- 🎭 Typosquat detection: Identifies packages similar to popular ones (potential typosquatting)
- 💡 Smart suggestions: Recommends likely intended packages for flagged dependencies
- 🎨 Beautiful output: Color-coded terminal tables with clear risk levels
- 📋 JSON mode: Machine-readable output for CI/CD integration
- ⚡ Fast: Concurrent registry checks with rate limiting
- 🛡️ Production-ready: Comprehensive error handling and graceful degradation