GhostDep: Real Packages Only for AI Agents

The problem: AI coding agents now choose and install dependencies on their own, and they regularly suggest package names that don't exist. Research shows these invented names repeat predictably, so attackers register them on PyPI and npm with malicious code, an attack called slopsquatting. Typosquats like "reqeusts" (for "requests") work the same way. One wrong install gives an attacker code execution on a developer's machine or in CI. The solution: GhostDep is a security checkpoint between the agent and the package installer. Five deterministic checks (registry existence, package age, download popularity, similarity to the top 5,000 PyPI packages, and known vulnerabilities from OSV.dev for the exact version) produce a SAFE, SUSPICIOUS or BLOCKED verdict with plain-language reasons and, for typosquats, the real package to use instead. Target users are developers and teams who let AI coding agents write code, and the platform or security teams responsible for their dependencies. Developers keep their habits: their agent calls GhostDep automatically, "ghostdep install" replaces "pip install", a pre-commit hook checks dependency files, and a GitHub Action reports results in GitHub's security tab (SARIF). Security teams set the rules once in a policy file that allows private packages and denies risky ones. What makes it unique: GhostDep is agent-native. In IBM Bob it runs as an MCP server with a Skill and a custom "Dependency Guardian" mode, so the check happens inside the agent's decision. When a package is blocked, Bob explains why, picks a safe alternative and finishes the task, instead of a human discovering an error later. Existing dependency tools mostly scan packages you already chose; GhostDep also covers names that don't exist yet. Proof that it works: during the hackathon, GhostDep blocked "reqeusts", a 3-day-old package with 5 downloads imitating "requests"; by the next morning it was gone from PyPI. A scheduled Radar job now sweeps PyPI's newest uploads and publishes possible lookalikes on the project site. The repo includes a 75-package benchmark, a replay of historical PyPI typosquat attacks, and 163 automated tests. Efficiency: checks are deterministic (no LLM calls) and cached, so repeat checks are instant and the verdict is always explainable.