Make it look the package up before installing: does it exist on the official registry, who publishes it, when was it first published, and how many versions does it have. Roughly one in five packages recommended by code models does not exist, and the invented names repeat — which means attackers can register them in advance. A package first published weeks ago, with one version and an unknown publisher, is the attack.
The prompt
List every package this change adds or updates. For each one: does it exist on the official registry, who publishes it, when was it first published, and how many versions does it have? Do not install anything yet.
| When to use it | Before accepting any change that touches dependencies. Every time — this is a thirty-second check. |
|---|---|
| Why it is worded that way | The four questions are chosen because they separate a real library from a freshly planted one. Existence catches the pure hallucination. Publisher catches the impostor under a familiar-looking name. First-published date and version count catch the package that was registered last month specifically because a model keeps suggesting that name. "Do not install anything yet" matters because the install itself is the moment someone else's code starts running on your machine. |
Why this is a real attack and not a theory
A study that generated 576,000 code samples across 16 models found 19.7 percent of recommended packages did not exist — over 205,000 distinct invented names. The important part is not the rate, it is the repeatability: rerunning the same prompts ten times, 43 percent of hallucinated names came back every single time. A name that is predictable is a name somebody can register before you ask for it. The practice has a name: slopsquatting.
The tell you are looking for
A genuine library has history: years of releases, a publisher you can trace to a project or a company, and a download pattern that did not start last month. A planted package has a plausible name and nothing behind it. You are not auditing code here — you are checking whether the thing has a past.
Why the agent will not do this on its own
Installing is the fastest route to working code, and an agent optimises for working code. It has no reason to be suspicious of a name that it produced itself, because to the agent the name is not a guess — it is simply what came next.
The habit that makes it stick
Put it in your project rules once: "Before running any install command, show me the exact command and wait." Then this check happens at the only moment it can still prevent anything, rather than after the fact.
The Operator Prompt Pack
This is one of 60 prompts, from the phase "Dependencies: what it is about to install". The pack has the rest, each with the same reasoning underneath, plus the research they are built on and a house-rules file you paste in once.
Tools this applies to
| Tool | What it does | Price |
|---|---|---|
| Claude Code | An AI agent in your terminal that reads your files, edits them, runs commands and deploys. | ~€17–20/mo |
| GitHub | Version control. Your restore point when an hour of building goes wrong. | Free |
Every tool has its own page with what it costs and who should skip it. Some links are affiliate links.
More prompts like this
The prompt that stops an AI agent going in circles
What do you do when an AI coding agent keeps trying fixes that do not work?
The prompt to run before any app with a database goes live
How do you check whether your database is exposed before launching an app?