pkgtruthBLOCK
Ground truth about npm packages for AI coding agents. Catches hallucinated and slopsquatted dependencies before they reach your lockfile.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/pkgtruth) [](https://github.com/hxckya/pkgtruth/actions/workflows/ci.yml) [](https://nodejs.org) [](LICENSE)
Ground truth about npm and PyPI packages, for AI coding agents and CI.
Your agent just wrote npm install unused-imports. That package is not the linter plugin it meant. It is a name an attacker registered because models kept inventing it — and npm has since replaced it with a security placeholder.
pkgtruth catches that before it reaches your lockfile — as an MCP server the agent asks, a CLI for CI, a GitHub Action on pull requests, or a Claude Code hook that denies the install command itself.
Why this exists
Large language models invent package names. Measured across models, 19.7% of generated package names were hallucinated, and when researchers re-ran the prompts, 43% of those names came back every single time.
That reproducibility is the whole attack. An attacker does not need to compromise a maintainer, poison a build server, or find a vulnerability. They watch what models invent, register the name, and wait. The technique is called slopsquatting, and it is already happening in the wild.
The standing security advice is that agents with package-management capabilities should not install anything without a review gate. pkgtruth is that gate, in a form an agent can call on its own.
Found in the wild
Two names a model plausibly produces, both live on npm today:
a44c65d0b994OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add pkgtruth -- npx -y [email protected]
Exposed tools (3)
2 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
check_dependencies | read | |
check_install_command | write | |
check_package | read |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (2 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (9)
sudo: /^-(u|g|C|D|p|r|t|T|U|h)$/,
'including behind `sudo`, `&&` chains and `sh -c`. Extracts the package names (npm and PyPI at once), ' +
.mcp.json.example
process.env.PKGTRUTH_DOWNLOADS_API = 'https://127.0.0.1:9';
assert.deepEqual(npm('FOO=1 sudo -E npm i -g pkgtruth'), ['pkgtruth']);assert.deepEqual(npm('sudo -u deploy npm i left-pad'), ['left-pad']);@modelcontextprotocol/sdk, zod
lodash, crossenv, imageprocessor-lite
system use found in code, not declared in the description
Gates applied: no_behavioural_pass.
a44c65d0b994full audit observations/trust-audit/mcp-server/hxckya__pkgtruth.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | a44c65d0b994 | BLOCK | D | 69 | first audit |
Questions
What is the pkgtruth MCP server?
Ground truth about npm packages for AI coding agents. Catches hallucinated and slopsquatted dependencies before they reach your lockfile.
What tools does pkgtruth expose?
3 in total: 2 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is pkgtruth safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does pkgtruth need?
No credential environment variables were found in its source, so it appears to need none.
How does pkgtruth run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as fixture-slopsquat at 0.2.2.
How current is this page?
The grade is for one exact copy of the source (a44c65d0b994), read on 2026-10-11. The repository is watched and re-audited when it changes.