Aditya Kumar Sharma@adishxm

Problem Statement: AI coding agents frequently recommend non-existent packages or hallucinate function exports from valid packages (USENIX Security research highlights a 19.7% package hallucination rate across popular LLM recommendations). Existing security tools check if a package name exists, but miss the dangerous gap where a package exists on npm, yet the specific function or symbol generated by the AI does not. Executing "npm install" blindly exposes repositories to supply-chain attacks, broken builds, and runtime crashes. The Solution: Phantomdeps is a deterministic, verification-only pre-install claim gate designed specifically for AI coding workflows. It intercepts dependency installation commands, downloads package tarballs, and statically inspects exported AST declarations and TypeScript definition files (.d.ts) without executing any package code or lifecycle scripts (preinstall/postinstall). If a package or claimed symbol is missing, Phantomdeps blocks installation instantly and provides an evidence card with a human-reviewable remediation patch. Target Users & Interaction: Designed for developers, AI agent builders, and enterprise security teams using AI coding assistants such as IBM Bob. Users interact with Phantomdeps automatically via IBM Bob's PreToolUse hook or directly through the CLI (phantomdeps check <package>). When an AI agent proposes an install command, Phantomdeps evaluates it seamlessly in milliseconds. If flagged (BLOCK), developers receive a structured evidence card and cited code diff proposing the correct import. Uniqueness & Innovation: 1. Zero Code Execution: Uses byte-level tarball stream parsing and AST export mapping without importing third-party modules. 2. Complete Claim Verification: Checks both package existence and exact symbol/export signature match. 3. Cryptographic Tamper-Evident Ledger: Every verification log is saved to an audit trail with SHA-256 hash chaining (phantomdeps audit-log verify). 4. Fail-Closed Integration: Rejects unsafe shell metacharacters and invalid protocols before execution occurs. Impact & Efficiency: Phantomdeps resolves hallucination risk prior to package download, preventing supply-chain pollution, saving developer debugging time, and providing a reliable guardrail for autonomous AI code generation.

🌎 Hybrid Hackathon | 💻 Online Build: 12-17 October 2026 | On-site phase: 17-18 October 2026 To participate in the hackathon, simply click Sign up with AMD. If you are not already a member of the AMD AI Developer Program (ADP), you will need to create an account. The AMD Developer Hackathon: ACT III is a hands-on event for developers, founders, engineers and builders who want to push what’s possible with AI on real infrastructure. 📍 If approved for the on-site experience, you'll also have the opportunity to showcase your project live. Travel and accommodation will not be covered.

💻 Online Hackathon | ⏳ Build: 48 hours | 📅 September 25–27, 2026 The official IBM Bob 2.0 hackathon. Build what's next in AI-assisted development, alongside the developers and experts shaping it. ⭐ Get help from experts throughout the event 🤝 Join a team or build solo 💰 Prize pool: $12,000 🧑🏻‍💻 Register before the Kick-Off Stream to start building with Bob