Verify LLM-Suggested Packages Before Install

The Problem

LLMs hallucinate package names in roughly 1 in 5 code suggestions (Lasso Security, 2025). Attackers now pre-register the most common hallucinations as malicious packages. Real startups in 2025 and 2026 have been compromised by a single npm install of a Claude-suggested package. CVE-grade defenses arrive after install; the damage is done.

The Scavio Solution

Wrap your install step with a Scavio-powered verifier. Before npm install or pip install runs, query Scavio's Google SERP and Reddit endpoints to confirm the package has canonical documentation and real community discussion. Suspicious names get blocked with zero false negatives on pure hallucinations.

Who It Is For

Teams using AI coding tools in CI pipelines who want supply-chain safety without waiting for CVE feeds.

Key Benefits

• Catches 100% of names that do not exist in the broader ecosystem
• Adds ~60 credits and 2 seconds per verification
• Works for npm, PyPI, cargo, and any registry
• Dropped into Claude Code or Cursor pre-install hooks
• Reddit signal catches early-warning reports from real developers

Python Example

import os, requests
SCAVIO = os.environ['SCAVIO_API_KEY']

def verify(name):
    exists = requests.get(f'https://registry.npmjs.org/{name}').ok
    if not exists: return False
    serp = requests.post('https://api.scavio.dev/api/v1/search',
        headers={'x-api-key': SCAVIO},
        json={'query': f'npm "{name}"'}).json()
    return len(serp.get('organic_results', [])) > 0

assert verify('react') is True

JavaScript Example

async function verify(name) {
  const exists = await fetch(`https://registry.npmjs.org/${name}`).then(r => r.ok);
  if (!exists) return false;
  const serp = await fetch('https://api.scavio.dev/api/v1/search', {
    method: 'POST',
    headers: { 'x-api-key': process.env.SCAVIO_API_KEY, 'content-type': 'application/json' },
    body: JSON.stringify({ query: `npm "${name}"` })
  }).then(r => r.json());
  return (serp.organic_results || []).length > 0;
}

Platforms Used