What Sentinel does

Sentinel is FlagThis's own prototype for catching package-squatting and "slopsquatting" — packages published on PyPI or npm under names that AI coding assistants are statistically likely to hallucinate and hand to developers as a real dependency. It watches new package publishes and scores each one automatically, so a suspicious registration can surface before it accumulates real install volume.

Current coverage status

Live monitoring is already on: every new package published to PyPI or npm gets scored as it comes in, so the newest, highest-risk registrations — the ones this tool is actually built to catch early — are covered from day one. What's still catching up is the historical backlog: Sentinel is working through older, already-published packages to backfill scores for them, so a package's absence from the results right now can mean either "not suspicious" or "not backfilled yet," not "cleared." That backlog will keep shrinking; it doesn't affect coverage of anything published going forward.

What it looks for

• Naming pattern — whether the package name matches a common AI-hallucination template (a plausible-sounding combination of framework, vendor, and capability words) rather than an organically-adopted name.
• Publisher identity — whether the publishing account's email domain matches the brand the package name claims to belong to.
• Code & usage signals — a near-empty codebase (a common signature of a reservation stub) and download velocity relative to how recently the package was published (see the Growing Packages tab).

What it is not

Sentinel's verdicts are automated, unconfirmed signals, not adjudicated findings. A flagged package can be a false positive, or the account behind it can be compromised rather than malicious. Its coverage is intentionally narrow — a small set of heuristics across two registries, not a comprehensive detector — and every score exists to surface a candidate worth a human's attention, not to accuse anyone.

Why this exists

Modern LLMs hallucinate package and domain names deterministically, not randomly — the same model hands thousands of different developers the exact same fabricated recommendation. In one academic benchmark, 43% of hallucinated package names repeated across every one of ten identical prompt runs, and Palo Alto Networks' Unit 42 found real adversaries typically take 18 to 51 days to notice a persistent hallucination and register it. Sentinel is a narrow attempt to shrink that window from the defender's side: flag suspicious registrations early, rather than waiting to find one already sitting in a compromised dependency tree.