🤝 Top Collaborators
.png&w=640&q=75)
🤓 Latest Submissions
Phantomdeps
Problem Statement: AI coding agents frequently recommend non-existent packages or hallucinate function exports from valid packages (USENIX Security research highlights a 19.7% package hallucination rate across popular LLM recommendations). Existing security tools check if a package name exists, but miss the dangerous gap where a package exists on npm, yet the specific function or symbol generated by the AI does not. Executing "npm install" blindly exposes repositories to supply-chain attacks, broken builds, and runtime crashes. The Solution: Phantomdeps is a deterministic, verification-only pre-install claim gate designed specifically for AI coding workflows. It intercepts dependency installation commands, downloads package tarballs, and statically inspects exported AST declarations and TypeScript definition files (.d.ts) without executing any package code or lifecycle scripts (preinstall/postinstall). If a package or claimed symbol is missing, Phantomdeps blocks installation instantly and provides an evidence card with a human-reviewable remediation patch. Target Users & Interaction: Designed for developers, AI agent builders, and enterprise security teams using AI coding assistants such as IBM Bob. Users interact with Phantomdeps automatically via IBM Bob's PreToolUse hook or directly through the CLI (phantomdeps check <package>). When an AI agent proposes an install command, Phantomdeps evaluates it seamlessly in milliseconds. If flagged (BLOCK), developers receive a structured evidence card and cited code diff proposing the correct import. Uniqueness & Innovation: 1. Zero Code Execution: Uses byte-level tarball stream parsing and AST export mapping without importing third-party modules. 2. Complete Claim Verification: Checks both package existence and exact symbol/export signature match. 3. Cryptographic Tamper-Evident Ledger: Every verification log is saved to an audit trail with SHA-256 hash chaining (phantomdeps audit-log verify). 4. Fail-Closed Integration: Rejects unsafe shell metacharacters and invalid protocols before execution occurs. Impact & Efficiency: Phantomdeps resolves hallucination risk prior to package download, preventing supply-chain pollution, saving developer debugging time, and providing a reliable guardrail for autonomous AI code generation.
27 Sep 2026
