loicguillois/slopwatch
Detect slopsquatting attacks — AI-hallucinated packages in your dependencies
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Mar 2, 2026
- License
- MIT
Pinned Snippet
uses: loicguillois/slopwatch@8487179715f74bdc66e14d50e1c429c7f2472aa8 # v0.2.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to the project directory to scan | no | . |
| format | Output format: terminal, json, sarif | no | sarif |
| threshold | Trust score threshold for CRITICAL severity (default: 22) | no | 22 |
| fail-on-critical | Fail the action if CRITICAL packages are found | no | true |
| version | slopwatch version to use (default: latest) | no | latest |
| comment-on-pr | Post a comment on the PR with critical packages (default: true) | no | true |
Outputs
| name | description |
|---|---|
| results | JSON scan results |
| critical-count | Number of CRITICAL packages found |