Developer builds tool to auto-block hallucinated npm/PyPI packages in Claude Code

·1 views

A developer has integrated SlopScan, an open-source API, into Claude Code to automatically verify npm and PyPI package names before installation. The tool addresses 'slopsquatting', where attackers pre-register hallucinated package names — which LLMs generate roughly 20% of the time — with malicious payloads on real registries. Around 43% of hallucinated package names are consistent across model runs, making them predictable targets for bad actors. The integration uses two complementary mechanisms: a skill file that Claude can consult on demand, and a deterministic PreToolUse hook that blocks installs without relying on the model's memory. SlopScan scores packages as SAFE, CAUTION, SUSPICIOUS, or DANGEROUS based on registry age, download counts, and GitHub signals.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Dev Tutorial: Implementing Paginated Property Listings with RTK Query

A developer tutorial published on DEV Community demonstrates how to build server-side pagination for a property listing web application using Redux Toolkit Query (RTK Query). The guide covers setting up a typed API slice with endpoints that accept page number, page size, search term, and status filter parameters. A React component called PropertyTable manages local state for pagination and search, using a debounce effect to limit API calls as users type. The tutorial also shows how to calculate total pages from the API response and conditionally render UI controls based on the logged-in user's role. The implementation targets a localhost REST API and uses Bearer token authentication via request headers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Documentation Should Be Treated as Part of Software Architecture

A software engineering perspective argues that documentation is not a post-development task but a core component of system architecture, on par with code itself. Undocumented design decisions — such as why a soft delete was chosen over a hard delete, or why a specific retry strategy was adopted — represent hidden constraints that future developers can unknowingly violate. Writing design documents before or during implementation, rather than after, forces engineers to surface flawed assumptions early, before costly code investment makes it harder to challenge an approach. Architecture Decision Records (ADRs) are highlighted as a practical tool for capturing the reasoning behind decisions, helping future engineers understand context that no compiler or code review can convey. The article concludes that treating documentation as optional leads to system decay even when all tests pass, because correctness of logic and correctness of intent are two entirely different things.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Four SQL Patterns That Power Social Network Features at Scale

Building social features like follows, feeds, and mutual connections may appear simple but requires well-known SQL query patterns to function reliably at scale. A follow relationship is typically stored in a basic adjacency table, but self-joins on that table become costly when high-follower accounts generate hundreds of thousands of intermediate rows. Feed timelines are handled via two strategies: fan-out on write pre-inserts posts into each follower's feed for fast reads, while fan-out on read computes the feed dynamically at query time, with production systems combining both approaches depending on follower count. Mutual-friend lookups are graph problems that strain standard SQL joins, and better-scaling solutions involve representing follow lists as sorted arrays or bitsets and intersecting them outside the join layer. Proper indexing in both directions, early use of LIMIT clauses, and hybrid fan-out strategies are the key engineering levers for keeping these queries performant.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Guide to Building QWeb PDF Reports in Odoo 19 Covers Beginner to Advanced Techniques

A comprehensive tutorial published on DEV Community walks developers through creating professional PDF reports in Odoo 19 using QWeb, the platform's XML-based templating engine. The guide explains the full report generation pipeline, from a user clicking 'Print' through ir.actions.report and QWeb template rendering to final PDF output via wkhtmltopdf. It covers foundational topics such as setting up module structure, registering report actions, and using core layout components like web.external_layout and div.page. Advanced techniques addressed include reusable templates, custom paper formats, barcodes, QR codes, multilingual and RTL support, and performance optimization. The tutorial aims to equip Odoo developers with best practices for building maintainable and scalable reports across use cases like invoices, purchase orders, and payroll documents.

0 comments Read more at DEV Community