Phase 6: Supply Chain Security & Slopsquatting · 50 min · Python · PyPI API · npm API

Hallucinated Package Detection

Verify before you install. Publisher identity, registration date, Levenshtein distance.

Real-world application: Engineers who can verify package names against registries with publisher identity and registration date checks demonstrate practical supply chain security skills.

What you will learn

Verify package names against registries (PyPI, npm) before installation
Check publisher identity and registration date (<90 days = red flag)
Calculate Levenshtein distance to detect typosquatting and name confusion
Detect cross-ecosystem conflation (8.7% of hallucinations)

Introduction

Hallucinated Package Detection

Objective

Run the package detection pipeline on 20 AI-recommended packages. Observe the 5 signals (registry, publisher, registration date, Levenshtein, cross-ecosystem) and the risk score for each package. Identify hallucinated, typosquatted, and cross-ecosystem conflated packages.

Verify before you install. Publisher identity, registration date, Levenshtein distance.

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers The Problem, The Concept, Build, Check Yourself, Key Terms & Next — plus a hands-on lab, quiz, and project artifact.

Create a free account — the opening phases of 29 of 35 courses are free, no credit card.

Key terms in this lesson

ReAct