slopcheck

Scan files for npm install, npx, pnpm add, yarn add, bun add, and bunx commands, extract package names, and validate each against the live npm registry. Packages that don't exist are reported as phantom packages (hallucinations). Packages with HTTP 451 responses are flagged as security holds (removed for malware).

Zero runtime dependencies. Uses only Node.js built-in APIs.

When to use

• Before installing packages from any AI-generated file (SKILL.md, AGENTS.md, .cursorrules, README.md)
• Before committing markdown or config files that reference npm packages
• When reviewing pull requests that add new package references in documentation
• After generating code or documentation that includes install commands

Commands

# Scan specific files
npx slopcheck SKILL.md README.md