omp packages

pi-dependency-guard0.1.1

Hallucination detector & package security audit extension for Pi Coding Agent

luisito15 Published 1 month ago MIT ~259 downloads/mo

Untested on omp

This is a pi package. No one has reported whether it works on omp yet. If you try it, add your result below.

Did it work for you?

Result

One report per person. A new report replaces your old one.

Reports 0

No reports yet.

Readme

pi-dependency-guard banner

npm version CI status Pi compatible License Node version

🛡️ Overview

pi-dependency-guard prevents AI hallucinations and supply-chain vulnerabilities from entering your project through Pi Coding Agent.

LLMs commonly hallucinate non-existent package names when writing import statements or proposing installation commands (e.g. npm i fast-auth-helper-ai). Attackers actively exploit this via package hallucination typosquatting, registering fabricated names on npm and PyPI with malicious payloads.

pi-dependency-guard intercepts install commands and validates every dependency against the official registries in real time before execution.

┌─────────────────┐       proposes install       ┌────────────────────────┐
│                 │ ───────────────────────────> │                        │
│    Pi Agent     │                              │  pi-dependency-guard   │
│                 │ <─────────────────────────── │                        │
└─────────────────┘        risk evaluation       └───────────┬────────────┘
                                                             │
                                          queries registry   │
                                                             ▼
                                                 ┌────────────────────────┐
                                                 │   npm / PyPI API       │
                                                 │ (404 -> Hallucinated)  │
                                                 └────────────────────────┘

✨ Features

  • 🚫 Zero Hallucinations: Instantly flags non-existent packages as CRITICAL risk.
  • 🌐 Direct Registry Verification: Hits official registry.npmjs.org and pypi.org endpoints without middlemen.
  • ⏳ Age & Download Analysis: Warns on packages newer than 7 days or with fewer than 100 monthly downloads.
  • ⚡ Multi-Ecosystem Parsing: Detects packages in npm install, pnpm add, yarn add, and pip install.
  • 🤖 Agent Self-Audit Tool (audit_package): Enables Pi to self-verify library existence before generating code.

🚀 Installation

Via Pi Package Registry (Recommended)

pi install npm:pi-dependency-guard

Direct from GitHub

pi install git:https://github.com/lleontor705/pi-dependency-guard.git

From Local Source

git clone https://github.com/lleontor705/pi-dependency-guard.git
cd pi-dependency-guard
npm install && npm run build
pi install ./

📖 Usage & Commands

Slash Commands

Command Description
/guard check npm <pkg> Queries the npm registry for release date, version, and monthly downloads.
/guard check pypi <pkg> Queries PyPI for Python packages.
/guard scan <command> Parses an entire command (e.g., npm i express lodash-es) and audits all packages.

Agent Autonomous Tool (audit_package)

Pi uses this tool before proposing any unfamiliar library:

{
  "packageName": "express-jwt-easy",
  "ecosystem": "npm"
}

Response:

{
  "packageName": "express-jwt-easy",
  "ecosystem": "npm",
  "exists": false,
  "isHallucinated": true,
  "riskLevel": "CRITICAL",
  "reasons": [
    "Package \"express-jwt-easy\" does NOT exist in the official npm registry (Hallucination detected)."
  ]
}

Pi immediately halts the hallucinated suggestion and proposes a real package like express-jwt.

🏗️ Architecture & Development

# Clone
git clone https://github.com/lleontor705/pi-dependency-guard.git
cd pi-dependency-guard

# Install & Build
npm install
npm run build

📄 License

MIT © Luis Leon