Show HN: Phantom Guard – Detect AI-hallucinated package attacks

The attack vector: AI assistants hallucinate package names → attackers register those names with malware → developers install malware thinking it's legit.

How it works: 1. Checks if packages exist on registries 2. Matches against 10+ AI hallucination patterns 3. Detects typosquats of top 3000 packages 4. Analyzes metadata (age, downloads, maintainers)

``` pip install phantom-guard phantom-guard validate flask-gpt-helper # HIGH_RISK: Package not found, matches pattern ```

Performance: Try the live demo: https://matte1782.github.io/phantom_guard/

GitHub: https://github.com/matte1782/phantom_guard

Show HN: Phantom Guard – Detect AI-hallucinated package attacks
github.com

  The primary signal is whether the package exists on the registry. We query PyPI/npm directly:
  - If a package exists → it gets a low/safe risk score
  - If a package doesn't exist → that's the main red flag for slopsquatting

  Pattern matching (like AI-related terms) is just one of many weighted signals, and it's far outweighed by existence. In fact, popular packages get a negative weight that actively reduces their risk score.

  The attack we're detecting is when an LLM hallucinates a package name like flask-gpt-utils that sounds plausible but doesn't exist. A real attacker could then register that name and wait for developers to pip install it.

  We test against the top 1000 PyPI packages and target