dependency-verificationlisted

# Dependency Verification (pre-install name check) > A package name the model produced is a **claim**, not a fact. The registry is the fact. Verify > before you install. Adapted (stack-agnostic) from the MIT-licensed > [`athola/claude-night-market`](https://github.com/athola/claude-night-market) `dependency-verification` skill. ## Why this exists Code-generating models recommend packages that **do not exist** at a measured rate of ~5% (commercial models) to ~22% (open models), and ~58% of the hallucinated names *recur* across reruns — so an attacker can predict a commonly-hallucinated name, register the empty slot, and ship malware. This is **"slopsquatting"** (the LLM-era cousin of typosquatting). A proof-of-concept package registered against a frequently-hallucinated name drew tens of thousands of installs. The rate does *not* fall to zero with a better model. The defense is cheap: **confirm the name exists in its registry before you install or recommend it.** ## When to use Before any of: - running an install command — `pip install`, `uv add`, `npm install`, `pnpm add`, `yarn add`, `cargo add`, `go get`, `poetry add`, `gem install`, `composer require`, … - writing a dependency into a manifest — `pyproject.toml`, `requirements.txt`, `package.json`, `Cargo.toml`, `go.mod`, `Gemfile`, … - **recommending a package to the user in prose** (a hallucinated recommendation is still a defect). ## The two failure signals A candidate fails verification on **either**: 1. **N