CI Gate Script Aims to Block AI-Hallucinated Package Installs Before They Run

·1 views

A developer has published a model-agnostic Python script designed to intercept unverified package suggestions made by AI coding assistants before they reach installation. The tool, called a 'slopsquatting gate,' checks any proposed dependency against three criteria: presence in a pinned lockfile, inclusion in a human-maintained allowlist, and absence of suspicious similarity to known legitimate packages. The gate is intended to run in CI pipelines before any install step or registry credentials are mounted, using only Python 3.11+ standard library with no network calls. The approach addresses a supply-chain risk where AI-hallucinated package names can slip into pull requests and pass CI checks simply because the install succeeds. The article was written as part of outreach for MonkeyCode, though the author notes the workflow functions independently of any specific model or platform.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Eight-Year-Old WooCommerce Site Had 12,000 Orphaned WebP Files Slowing It Down

A developer auditing a WooCommerce-LearnDash site found 12,301 WebP sidecar files left behind by a previously uninstalled image optimizer plugin, consuming 241MB of storage and burdening backups and malware scans. The files, generated by EWWW Image Optimizer, were completely unreferenced and served no purpose once the plugin was removed. A separate audit revealed that a plugin called disable-thumbnails-and-threshold had silently stripped 14 registered image sizes at runtime, meaning WooCommerce product thumbnails were never actually generated on disk. Rather than proceeding with a new WebP conversion tool, the developer resolved these deeper structural issues first, noting that installing another optimizer would have compounded the existing problems. The case highlights the importance of auditing inherited WordPress sites for orphaned files and misconfigured plugins before adding new optimization layers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds minimal web search agent, then audits whether it earns the label

A developer built a Perplexity-style search assistant using a Bun backend, React 19 frontend, Tavily for search, and OpenRouter as the model provider. The system allows a language model to autonomously decide when to call a web search tool, loop through results, and stream cited answers to users. Before publishing about the project, the developer paused to honestly assess whether the build qualified as a true 'agent harness' or merely a well-dressed API call. After reviewing the core agent loop code, they confirmed it meets the harness definition: the model controls tool use, the loop iterates until completion, context is trimmed, and output is a structured event stream. The developer acknowledged the build is a single-tool harness with no retries or provider fallback, and noted that a more robust multi-tool version remains a future goal.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

22 Native Browser Features That Can Replace Common JavaScript Libraries

A developer-focused article highlights 22 built-in browser capabilities that eliminate the need for third-party JavaScript libraries in many common use cases. Features such as native dialogs, the Popover API, color pickers, and the Clipboard API are now supported directly in modern browsers without additional dependencies. The Web Share API, lazy image loading, smooth scrolling via CSS, and the Geolocation API are among the other built-in tools covered. HTML elements like details and summary enable accordion-style components, while the Notification API allows desktop alerts, all natively. The piece argues that developers can write less code and reduce reliance on external packages by leveraging these modern browser standards.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Simple UTM conventions that keep your marketing analytics clean and reliable

UTM parameters lack built-in validation, meaning inconsistent tagging by team members over time can silently fragment analytics data into untrustworthy reports. Key rules include always using lowercase letters, hyphens instead of spaces or underscores, and appending the year to campaign names to avoid data stacking across recurring events. Marketers often confuse utm_source and utm_medium — source identifies the specific place (e.g., instagram), while medium describes the channel type (e.g., social). UTM tags should only be applied to external links, as tagging internal site navigation can overwrite original referrer data and corrupt attribution. Maintaining a short, team-accessible reference list of approved parameter values is recommended to prevent gradual naming drift across campaigns.

0 comments Read more at DEV Community