Check each install against the package registry before it runs. Models invent package names and version numbers that sound right. A made-up name fails at best; at worst, someone has registered it with malicious code, an attack known as slopsquatting.
Models predict names from patterns, so invented packages are common and often repeat. Trend Micro's slopsquatting research tested Claude Code, Codex CLI and Cursor and found even advanced agents still suggest packages that don't exist. Versions are a quieter version of the same problem: the package is real, the version asked for isn't.
npm view <name> or check PyPI before installing anything new.Check checks install commands against npm, PyPI, crates.io, RubyGems, Packagist, NuGet, Homebrew, Chocolatey and the PowerShell Gallery, including the version asked for. The same goes for a package npx, pnpm dlx, bunx, uvx or pipx would download and run, a Docker image or tag being pulled, a package a JavaScript or TypeScript file starts importing, and the module python -m would run.
If your machine installs from a private registry, Check sees that and doesn't judge those packages against the public one, so a real private package is never blocked.
100 free blocks, then A$0.10 for each action Check stops, from a prepaid balance. Allowed actions are always free. No subscription. Windows and Linux; macOS isn't supported yet. Get your key at the console, then run this in your own terminal:
npx @golproductions/check@latest --installOr add Check as a plugin for Claude Code, Gemini CLI, Copilot CLI or Codex: the guide. Everything Check checks, and what it lets through: What Check does.
100 free blocks. Get your GOL API Key at the console.