The package that
doesn't exist is
still one import away.
Warden CI scans every pull request the moment it opens, explains the evidence behind each finding, and guides safe remediation from proposal to validated branch and pull request. Dependency fixes are verified only after a fresh re-scan; secrets and unsafe code stay human-reviewed. Nothing about your code is stored.
Warden CI — check run
2 findings
- ✕ react-fast-pagination not found on npm registry
- ✕ hardcoded credential detected on line 14
simulated example — replays automatically
Why this exists now
AI assistants don't just write bugs. Sometimes they write dependencies that were never real.
Researchers analyzing hundreds of thousands of AI-generated code samples found commercial models invent nonexistent package names in roughly 1 in 20 suggestions — and open-source models in as many as 1 in 5. Register one of those exact names on npm or PyPI and you get a working supply-chain attack, a technique now known as slopsquatting.
avg. hallucination rate, commercial models
avg. hallucination rate, open-source models
registries checked live — npm & PyPI
bytes of your source code stored
Source: Spracklen et al., "We Have a Package for You!" (USENIX Security), 576,000 generated code samples across 16 models.
What actually runs on every PR
Six checks. Added lines only.
Warden CI never re-scans code your PR didn't touch — only the lines actually added in the diff, so nothing pre-existing generates new noise.
Hallucinated package detection
Every added import/require is checked against the live npm and PyPI registries. If the package doesn't exist, it's flagged before anyone installs it.
Typosquat & freshness signal
Packages that exist but were published in the last 45 days and sit within a couple characters of a popular name get flagged as a likely typosquat, not waved through clean.
Hardcoded secret detection
Flags API keys, tokens, and credentials that show up in newly added lines, before they land in a commit history that's painful to scrub.
Dangerous execution patterns
Catches eval(), new Function(), and unguarded shell execution added in a PR — common in scaffolded or unreviewed AI output.
Diff-only scanning
Only lines actually added in the pull request are analyzed — never the rest of the file — so untouched legacy code never generates a false alarm.
Zero source persistence
Diffs are parsed in memory to run these checks, then discarded. No source code is written to a database — see the Security section below.
How it works
Three steps, no YAML.
Install the GitHub App
Add Warden CI to an organization or a single repository from the GitHub Marketplace. No config file, no YAML to write or maintain.
Open or update a pull request
The moment a PR is opened, reopened, or pushed to, Warden verifies GitHub's webhook signature and reads only the lines that changed.
Findings post as a Check Run
Results appear directly on the pull request, in the same place as your other CI checks. Non-blocking by default — you decide what to do with them.
Security & privacy
Nothing to leak, because nothing is kept.
Your code is your company's most sensitive asset. Warden CI parses pull request diffs in memory purely to run its checks, and discards them immediately after — there's no source-code database to breach.
- No repository source code is written to disk or a database.
- Every webhook is verified with GitHub's HMAC-SHA256 signature before it's processed.
- GitHub App installation tokens are minted per repo and scoped only to the PR being checked.
- Only package names — never file contents — are sent to npm and PyPI to check existence.
// warden-ci · POST /api/github/webhooks
✓ SUCCESS payload validated via HMAC-SHA256
✓ MEMORY diff parsed in-memory, 0 bytes persisted
✓ AUDIT 2 flagged imports · 1 hardcoded secret
✓ CHECK posted to pull_request #482
warden@ci ~
What's next
Built in the open about what isn't done yet.
The checks above are live today. These are genuinely in progress — no marketing gloss.
VS Code extension
Catch a hallucinated npm import the moment you accept an AI suggestion — before it's ever committed, not after.
crates.io & RubyGems
Same detection engine, more ecosystems. npm and PyPI are built behind a shared adapter interface designed for this.
Live popularity data
Replacing the static popular-package seed list with a scheduled feed of real npm/PyPI download counts.
Pricing
Simple, on purpose.
Two plans. Install free on GitHub Marketplace, upgrade any time via secure Paddle billing.
Free
For open-source projects and public repos.
- Unlimited public repository scans
- Hallucinated package detection (npm + PyPI)
- Secret & dangerous-exec detection
- Results posted as a GitHub Check Run
Pro
Everything in Free, plus private repos.
flat rate, per GitHub account or org · 14-day free trial
- Everything in Free
- Private repository scanning
- Cancel any time, prorated to period end
Running Warden across several orgs, or need an invoice? Team and Enterprise billing is available — contact us and we'll set it up.
FAQ
Questions, answered plainly.
What is a "hallucinated package"?
When an AI coding tool invents a plausible-looking package name that doesn't actually exist. If an attacker registers that exact name later — a technique called slopsquatting — anyone who installs it runs whatever code the attacker put there.
Does Warden CI read or store my source code?
It reads the diff of a pull request in memory to run its checks, then discards it. No source code is written to disk or a database. Full detail in the privacy policy.
Which package ecosystems are supported?
npm (JavaScript/TypeScript) and PyPI (Python) today. Each ecosystem is a self-contained adapter, so more registries are on the roadmap without touching the core detection logic.
Will Warden CI block my pull requests?
No. By default, findings post as a non-blocking GitHub Check alongside your other CI status checks — merges are never blocked automatically.
What's included in the Free plan?
Unlimited automated scanning of public repositories, at no cost, indefinitely. Private repositories require the Pro plan.
What actually triggers a scan?
The GitHub pull_request webhook events opened, synchronize (new commits pushed), and reopened. Each run re-checks only the lines added since the last scan.
Stop merging packages that don't exist.
Install takes about two minutes. The first scan runs on your very next pull request.
Install on GitHub — Free