ghostimport

Stops your AI coding agent from installing npm packages that don't exist.

How the attack works →

---

Your agent invents a package name. It doesn't exist on npm *yet*. Someone is watching for exactly that, and the moment they register it, `npm install` runs their `postinstall` script on your machine.

This is **slopsquatting**. `npm audit`, Snyk and Socket don't catch it — they only inspect packages you've already installed. ghostimport checks names against the live registry at the moment your agent writes or installs them.

$ ghostimport

  Scanned 142 files · 38 packages

  ✗ react-server-fetch  does not exist on npm
    ↳ src/data/loader.ts
    ↳ unregistered — anyone could claim this name with a malicious postinstall

  ✗ axois  high risk
    ↳ src/api/client.ts
    ↳ 1-2 chars from 'axios' — likely a typo
    ↳ has postinstall script — runs code on npm install
    created 2019-08-29 · 1245/week · 1 version

  2 problems found.

Install

npm install -g ghostimport     # or: npx ghostimport

Node.js 22+. Zero runtime dependencies — the published package uses only Node built-ins.

Use it w