coding-agent-audit 0.3.3__tar.gz → 0.4.0__tar.gz

{coding_agent_audit-0.3.3/src/coding_agent_audit.egg-info → coding_agent_audit-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-agent-audit
-Version: 0.3.3
+Version: 0.4.0
 Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server.
 Author-email: StackScribe AI <survivalagent320@gmail.com>
 License: MIT
@@ -80,6 +80,10 @@ agent-audit --json
 # only one half of the scan
 agent-audit --skip-config   # IOC-only
 agent-audit --skip-ioc      # config-heuristics only
+
+# also check package.json/requirements.txt/pyproject.toml deps against
+# npm/PyPI and flag any that don't exist (hallucinated/slopsquattable name)
+agent-audit --project /path/to/repo --check-deps
 ```
 
 Exit codes: `0` nothing found, `1` only warning/info findings, `2` at least
@@ -111,6 +115,17 @@ second look rather than proof of compromise:
 - Auto-approved permission rules that are unscoped wildcards (e.g.
   `Bash(*)`)
 
+**Phantom-dependency scan** (`phantomdeps.py`, opt-in via `--check-deps`) —
+reads `package.json` / `requirements.txt` / `pyproject.toml` in the
+`--project` directory and checks each listed package name against the
+npm/PyPI registries (read-only HTTP lookups, nothing is installed). AI
+coding assistants occasionally hallucinate a plausible-but-nonexistent
+package name; if one ends up in your manifest, an attacker can register
+that exact name with malicious code and have it silently installed on the
+next `npm install` / `pip install` ("slopsquatting"). Network errors are
+treated as inconclusive, not as a finding, so a flaky connection can't
+produce a false positive.
+
 New incidents can be added to `iocs.py` as data, without touching the
 check logic.
 

{coding_agent_audit-0.3.3 → coding_agent_audit-0.4.0}/README.md

@@ -59,6 +59,10 @@ agent-audit --json
 # only one half of the scan
 agent-audit --skip-config   # IOC-only
 agent-audit --skip-ioc      # config-heuristics only
+
+# also check package.json/requirements.txt/pyproject.toml deps against
+# npm/PyPI and flag any that don't exist (hallucinated/slopsquattable name)
+agent-audit --project /path/to/repo --check-deps
 ```
 
 Exit codes: `0` nothing found, `1` only warning/info findings, `2` at least
@@ -90,6 +94,17 @@ second look rather than proof of compromise:
 - Auto-approved permission rules that are unscoped wildcards (e.g.
   `Bash(*)`)
 
+**Phantom-dependency scan** (`phantomdeps.py`, opt-in via `--check-deps`) —
+reads `package.json` / `requirements.txt` / `pyproject.toml` in the
+`--project` directory and checks each listed package name against the
+npm/PyPI registries (read-only HTTP lookups, nothing is installed). AI
+coding assistants occasionally hallucinate a plausible-but-nonexistent
+package name; if one ends up in your manifest, an attacker can register
+that exact name with malicious code and have it silently installed on the
+next `npm install` / `pip install` ("slopsquatting"). Network errors are
+treated as inconclusive, not as a finding, so a flaky connection can't
+produce a false positive.
+
 New incidents can be added to `iocs.py` as data, without touching the
 check logic.
 

{coding_agent_audit-0.3.3 → coding_agent_audit-0.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "coding-agent-audit"
-version = "0.3.3"
+version = "0.4.0"
 description = "Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server."
 readme = "README.md"
 requires-python = ">=3.9"

{coding_agent_audit-0.3.3 → coding_agent_audit-0.4.0}/src/agentaudit/__init__.py

@@ -3,4 +3,4 @@ for AI coding assistants (Claude Code, Cursor, Windsurf, VS Code forks, MCP
 servers).
 """
 
-__version__ = "0.3.3"
+__version__ = "0.4.0"

{coding_agent_audit-0.3.3 → coding_agent_audit-0.4.0}/src/agentaudit/cli.py

@@ -9,6 +9,7 @@ from . import __version__
 from .checks import run_all_ioc_checks
 from .configscan import default_config_paths, scan_paths
 from .findings import Finding, worst_severity
+from .phantomdeps import check_phantom_dependencies
 
 _SEVERITY_ICON = {"critical": "[CRITICAL]", "warning": "[WARNING]", "info": "[INFO]"}
 
@@ -60,6 +61,16 @@ def build_parser() -> argparse.ArgumentParser:
         action="store_true",
         help="skip the risky-config heuristic scan (IOC-only)",
     )
+    parser.add_argument(
+        "--check-deps",
+        action="store_true",
+        help=(
+            "with --project, also check package.json/requirements.txt/"
+            "pyproject.toml dependencies against npm/PyPI and flag any "
+            "that don't exist (possible AI-hallucinated/slopsquattable "
+            "package name). Makes read-only network requests."
+        ),
+    )
     parser.add_argument("--json", action="store_true", help="output JSON instead of text")
     parser.add_argument(
         "--no-footer", action="store_true", help="suppress the closing promo line"
@@ -80,6 +91,9 @@ def main(argv: list[str] | None = None) -> int:
         paths = default_config_paths(home, args.project)
         findings += scan_paths(paths)
 
+    if args.check_deps and args.project is not None:
+        findings += check_phantom_dependencies(args.project)
+
     if args.json:
         print(json.dumps([f.to_dict() for f in findings], indent=2))
     else:

{coding_agent_audit-0.3.3 → coding_agent_audit-0.4.0}/src/agentaudit/mcp_server.py

@@ -19,6 +19,7 @@ from . import __version__
 from .checks import run_all_ioc_checks
 from .configscan import default_config_paths, scan_paths
 from .findings import Finding, worst_severity
+from .phantomdeps import check_phantom_dependencies
 
 server = MCPServer(
     name="coding-agent-audit",
@@ -79,6 +80,23 @@ def scan_mcp_config(project_dir: Optional[str] = None) -> str:
     return _render(scan_paths(paths))
 
 
+@server.tool()
+def scan_phantom_dependencies(project_dir: str) -> str:
+    """Check a project's package.json / requirements.txt / pyproject.toml
+    dependencies against the npm/PyPI registries and flag any package name
+    that doesn't actually exist there. AI coding assistants occasionally
+    hallucinate a plausible-but-nonexistent package name; if one ends up in
+    a manifest, an attacker can register that exact name with malicious
+    code and have it silently installed on the next install
+    ("slopsquatting"). Read-only HTTP lookups only; nothing is installed.
+
+    Args:
+        project_dir: path to the project directory containing the manifest
+            file(s) to check.
+    """
+    return _render(check_phantom_dependencies(Path(project_dir)))
+
+
 def main() -> None:
     server.run()
 

coding_agent_audit-0.4.0/src/agentaudit/phantomdeps.py

@@ -0,0 +1,201 @@
+"""Checks for dependency-manifest entries that reference a package which
+does not actually exist on the relevant registry (npm / PyPI).
+
+AI coding agents occasionally hallucinate plausible-but-nonexistent package
+names. If a project's manifest references one, an attacker can register
+that exact name on the registry with malicious code ("slopsquatting") and
+the next `npm install` / `pip install` run pulls it in silently. This module
+only reads local manifest files and makes read-only HTTP lookups against
+the public registries - it never installs or modifies anything.
+
+Network errors (offline, timeout, DNS failure, rate limiting) are treated
+as "unknown" rather than "phantom", so a flaky connection never produces a
+false positive.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import urllib.error
+import urllib.request
+from pathlib import Path
+from typing import Optional
+from urllib.parse import quote
+
+from .findings import Finding
+
+_REQUEST_TIMEOUT = 4
+_USER_AGENT = "coding-agent-audit (+https://github.com/stackscribe-ai/coding-agent-audit)"
+
+_NPM_NAME_RE = re.compile(r"^(@[a-z0-9][\w.-]*/)?[a-z0-9][\w.-]*$", re.IGNORECASE)
+# Stdlib / common built-in module names that show up in requirements-style
+# files but are never installed from PyPI under that name.
+_PY_SKIP = {"python", "pip", "setuptools", "wheel"}
+
+
+def _http_exists(url: str) -> Optional[bool]:
+    """Return True if `url` resolves (2xx), False if it 404s, None if the
+    check itself was inconclusive (network error, timeout, non-404 error)."""
+    req = urllib.request.Request(url, method="HEAD", headers={"User-Agent": _USER_AGENT})
+    try:
+        with urllib.request.urlopen(req, timeout=_REQUEST_TIMEOUT) as resp:
+            return 200 <= resp.status < 300
+    except urllib.error.HTTPError as exc:
+        if exc.code == 404:
+            return False
+        return None
+    except (urllib.error.URLError, OSError, TimeoutError):
+        return None
+
+
+def check_npm_package_exists(name: str) -> Optional[bool]:
+    if "/" in name:
+        scope, _, rest = name.partition("/")
+        encoded = f"{quote(scope, safe='')}%2F{quote(rest, safe='')}"
+    else:
+        encoded = quote(name, safe="")
+    return _http_exists(f"https://registry.npmjs.org/{encoded}")
+
+
+def check_pypi_package_exists(name: str) -> Optional[bool]:
+    return _http_exists(f"https://pypi.org/pypi/{quote(name, safe='')}/json")
+
+
+def parse_npm_package_names(path: Path) -> list[str]:
+    try:
+        data = json.loads(path.read_text())
+    except (OSError, json.JSONDecodeError):
+        return []
+    if not isinstance(data, dict):
+        return []
+    names: list[str] = []
+    for key in ("dependencies", "devDependencies", "peerDependencies", "optionalDependencies"):
+        deps = data.get(key)
+        if isinstance(deps, dict):
+            names.extend(n for n in deps if isinstance(n, str))
+    return names
+
+
+_REQ_LINE_RE = re.compile(r"^\s*([A-Za-z0-9][A-Za-z0-9._-]*)")
+
+
+def parse_requirements_txt(path: Path) -> list[str]:
+    try:
+        lines = path.read_text().splitlines()
+    except OSError:
+        return []
+    names: list[str] = []
+    for line in lines:
+        line = line.split("#", 1)[0].strip()
+        if not line or line.startswith(("-", "git+", "http://", "https://")):
+            continue
+        match = _REQ_LINE_RE.match(line)
+        if not match:
+            continue
+        name = match.group(1).lower()
+        if name not in _PY_SKIP:
+            names.append(name)
+    return names
+
+
+_TOML_DEP_LIST_RE = re.compile(r"(?m)^\s*dependencies\s*=\s*\[(.*?)\]", re.DOTALL)
+_TOML_STRING_RE = re.compile(r'"([^"]+)"|\'([^\']+)\'')
+_TOML_POETRY_TABLE_RE = re.compile(
+    r"(?m)^\[tool\.poetry\.(?:dependencies|dev-dependencies)\]\s*\n(.*?)(?=\n\[|\Z)", re.DOTALL
+)
+_TOML_POETRY_KEY_RE = re.compile(r"(?m)^\s*([A-Za-z0-9][A-Za-z0-9._-]*)\s*=")
+
+
+def parse_pyproject_packages(path: Path) -> list[str]:
+    """Best-effort regex extraction (no TOML parser dependency, no need for
+    3.11+ tomllib given this project's py3.9 floor). False negatives (a
+    dependency we fail to spot) are fine; this is a heuristic triage tool."""
+    try:
+        text = path.read_text()
+    except OSError:
+        return []
+    names: list[str] = []
+    for list_match in _TOML_DEP_LIST_RE.finditer(text):
+        for entry_match in _TOML_STRING_RE.finditer(list_match.group(1)):
+            entry = entry_match.group(1) or entry_match.group(2)
+            name = re.split(r"[<>=!~\[; ]", entry, 1)[0].strip()
+            if name:
+                names.append(name)
+    for table_match in _TOML_POETRY_TABLE_RE.finditer(text):
+        for key_match in _TOML_POETRY_KEY_RE.finditer(table_match.group(1)):
+            name = key_match.group(1)
+            if name.lower() != "python":
+                names.append(name)
+    return names
+
+
+def _is_plausible_npm_name(name: str) -> bool:
+    return bool(_NPM_NAME_RE.match(name))
+
+
+def check_phantom_dependencies(project_dir: Path) -> list[Finding]:
+    """Scan a project directory's manifest files for dependencies that
+    don't resolve on their registry."""
+    findings: list[Finding] = []
+
+    npm_names: dict[str, str] = {}
+    pkg_json = project_dir / "package.json"
+    if pkg_json.is_file():
+        for name in parse_npm_package_names(pkg_json):
+            if _is_plausible_npm_name(name):
+                npm_names.setdefault(name, str(pkg_json))
+
+    py_names: dict[str, str] = {}
+    requirements = project_dir / "requirements.txt"
+    if requirements.is_file():
+        for name in parse_requirements_txt(requirements):
+            py_names.setdefault(name, str(requirements))
+    pyproject = project_dir / "pyproject.toml"
+    if pyproject.is_file():
+        for name in parse_pyproject_packages(pyproject):
+            py_names.setdefault(name, str(pyproject))
+
+    for name, source in npm_names.items():
+        exists = check_npm_package_exists(name)
+        if exists is False:
+            findings.append(
+                Finding(
+                    check_id="phantom-dependency",
+                    severity="warning",
+                    title=f"npm dependency '{name}' not found on the npm registry",
+                    detail=(
+                        f"'{name}' is listed as a dependency but does not "
+                        f"exist on registry.npmjs.org. This can happen when "
+                        f"an AI coding assistant hallucinates a plausible "
+                        f"package name. Until it's removed or corrected, "
+                        f"anyone could publish a malicious package under "
+                        f"this exact name and have it silently installed on "
+                        f"the next `npm install` (slopsquatting)."
+                    ),
+                    path=source,
+                )
+            )
+
+    for name, source in py_names.items():
+        exists = check_pypi_package_exists(name)
+        if exists is False:
+            findings.append(
+                Finding(
+                    check_id="phantom-dependency",
+                    severity="warning",
+                    title=f"Python dependency '{name}' not found on PyPI",
+                    detail=(
+                        f"'{name}' is listed as a dependency but does not "
+                        f"exist on pypi.org. This can happen when an AI "
+                        f"coding assistant hallucinates a plausible package "
+                        f"name. Until it's removed or corrected, anyone "
+                        f"could publish a malicious package under this "
+                        f"exact name and have it silently installed on the "
+                        f"next `pip install` (slopsquatting)."
+                    ),
+                    path=source,
+                )
+            )
+
+    return findings

{coding_agent_audit-0.3.3 → coding_agent_audit-0.4.0/src/coding_agent_audit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-agent-audit
-Version: 0.3.3
+Version: 0.4.0
 Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server.
 Author-email: StackScribe AI <survivalagent320@gmail.com>
 License: MIT
@@ -80,6 +80,10 @@ agent-audit --json
 # only one half of the scan
 agent-audit --skip-config   # IOC-only
 agent-audit --skip-ioc      # config-heuristics only
+
+# also check package.json/requirements.txt/pyproject.toml deps against
+# npm/PyPI and flag any that don't exist (hallucinated/slopsquattable name)
+agent-audit --project /path/to/repo --check-deps
 ```
 
 Exit codes: `0` nothing found, `1` only warning/info findings, `2` at least
@@ -111,6 +115,17 @@ second look rather than proof of compromise:
 - Auto-approved permission rules that are unscoped wildcards (e.g.
   `Bash(*)`)
 
+**Phantom-dependency scan** (`phantomdeps.py`, opt-in via `--check-deps`) —
+reads `package.json` / `requirements.txt` / `pyproject.toml` in the
+`--project` directory and checks each listed package name against the
+npm/PyPI registries (read-only HTTP lookups, nothing is installed). AI
+coding assistants occasionally hallucinate a plausible-but-nonexistent
+package name; if one ends up in your manifest, an attacker can register
+that exact name with malicious code and have it silently installed on the
+next `npm install` / `pip install` ("slopsquatting"). Network errors are
+treated as inconclusive, not as a finding, so a flaky connection can't
+produce a false positive.
+
 New incidents can be added to `iocs.py` as data, without touching the
 check logic.
 

{coding_agent_audit-0.3.3 → coding_agent_audit-0.4.0}/src/coding_agent_audit.egg-info/SOURCES.txt

@@ -8,6 +8,7 @@ src/agentaudit/configscan.py
 src/agentaudit/findings.py
 src/agentaudit/iocs.py
 src/agentaudit/mcp_server.py
+src/agentaudit/phantomdeps.py
 src/coding_agent_audit.egg-info/PKG-INFO
 src/coding_agent_audit.egg-info/SOURCES.txt
 src/coding_agent_audit.egg-info/dependency_links.txt
@@ -17,4 +18,5 @@ src/coding_agent_audit.egg-info/top_level.txt
 tests/test_checks.py
 tests/test_cli.py
 tests/test_configscan.py
-tests/test_mcp_server.py
+tests/test_mcp_server.py
+tests/test_phantomdeps.py

coding_agent_audit-0.4.0/tests/test_phantomdeps.py

@@ -0,0 +1,96 @@
+from pathlib import Path
+from unittest.mock import patch
+
+from agentaudit.phantomdeps import (
+    check_phantom_dependencies,
+    parse_npm_package_names,
+    parse_pyproject_packages,
+    parse_requirements_txt,
+)
+
+
+def test_parse_npm_package_names(tmp_path: Path):
+    pkg = tmp_path / "package.json"
+    pkg.write_text(
+        '{"dependencies": {"left-pad": "1.0.0"}, '
+        '"devDependencies": {"@scope/tool": "2.0.0"}}'
+    )
+    names = parse_npm_package_names(pkg)
+    assert set(names) == {"left-pad", "@scope/tool"}
+
+
+def test_parse_npm_package_names_invalid_json(tmp_path: Path):
+    pkg = tmp_path / "package.json"
+    pkg.write_text("{not json")
+    assert parse_npm_package_names(pkg) == []
+
+
+def test_parse_requirements_txt(tmp_path: Path):
+    req = tmp_path / "requirements.txt"
+    req.write_text(
+        "requests==2.31.0\n"
+        "# a comment\n"
+        "\n"
+        "numpy>=1.20,<2.0\n"
+        "-e git+https://example.com/foo.git\n"
+        "pandas\n"
+    )
+    names = parse_requirements_txt(req)
+    assert names == ["requests", "numpy", "pandas"]
+
+
+def test_parse_pyproject_packages_pep621(tmp_path: Path):
+    pp = tmp_path / "pyproject.toml"
+    pp.write_text(
+        "[project]\n"
+        'dependencies = [\n'
+        '    "requests>=2.0",\n'
+        '    "totally-made-up-pkg-xyz",\n'
+        "]\n"
+    )
+    names = parse_pyproject_packages(pp)
+    assert set(names) == {"requests", "totally-made-up-pkg-xyz"}
+
+
+def test_parse_pyproject_packages_poetry(tmp_path: Path):
+    pp = tmp_path / "pyproject.toml"
+    pp.write_text(
+        "[tool.poetry.dependencies]\n"
+        'python = "^3.9"\n'
+        'requests = "^2.0"\n'
+        "\n"
+        "[tool.poetry.group.dev.dependencies]\n"
+        'pytest = "^7.0"\n'
+    )
+    names = parse_pyproject_packages(pp)
+    assert "requests" in names
+    assert "python" not in names
+
+
+def test_check_phantom_dependencies_flags_nonexistent_npm(tmp_path: Path):
+    (tmp_path / "package.json").write_text(
+        '{"dependencies": {"left-pad": "1.0.0", "definitely-not-a-real-pkg-9x7z": "1.0.0"}}'
+    )
+
+    def fake_exists(name: str):
+        return name != "definitely-not-a-real-pkg-9x7z"
+
+    with patch("agentaudit.phantomdeps.check_npm_package_exists", side_effect=fake_exists):
+        findings = check_phantom_dependencies(tmp_path)
+
+    assert len(findings) == 1
+    assert findings[0].check_id == "phantom-dependency"
+    assert "definitely-not-a-real-pkg-9x7z" in findings[0].title
+
+
+def test_check_phantom_dependencies_network_unknown_not_flagged(tmp_path: Path):
+    (tmp_path / "requirements.txt").write_text("some-package\n")
+
+    with patch("agentaudit.phantomdeps.check_pypi_package_exists", return_value=None):
+        findings = check_phantom_dependencies(tmp_path)
+
+    assert findings == []
+
+
+def test_check_phantom_dependencies_no_manifests(tmp_path: Path):
+    assert check_phantom_dependencies(tmp_path) == []