vulkro slopcheck
Checks a dependency list, for example one an AI coding agent suggested, for malicious, made-up or look-alike package names before you install them.
vulkro slopcheck --manifest ./package.json
pbpaste | vulkro slopcheck --list - --ecosystem npm
vulkro slopcheck --manifest . --format json
It works offline from data built into the binary. Only --online touches the network.
Flags
Pass one of --manifest or --list. With neither, a piped list is read from stdin.
| Flag | Description |
|---|---|
--manifest <PATH> | A manifest file or folder (package.json, requirements.txt, go.mod, Cargo.toml, pom.xml and more). |
--list <PATH> | A file of package names, one per line. - reads stdin. |
--ecosystem <ECO> | npm (default) or pypi, for --list. |
-f, --format <FORMAT> | table (default), json, sarif, ndjson and others. |
--online | Also ask the registry whether each name exists. Refused under VULKRO_OFFLINE=1. |
--ai | Add an advisory local-model explanation per flagged name. Never changes what is flagged or the exit code. |
What it flags
| Category | Severity | Meaning |
|---|---|---|
known-malicious | High | On the compromised-release list. |
hallucinated | High | A name AI models are known to invent. |
typosquat-of:<name> | Medium | One or two edits away from a popular package. |
suspicious-suffix | Low | A popular name plus -js, -cli or -py. |
Exit codes
0 nothing suspicious. 1 suspicious packages found. 2 bad arguments, unreadable input, or --online with VULKRO_OFFLINE=1.
See also: vulkro respond, vulkro intel.