Package does not exist, name risk
Scan rule · RSC-SEC-151
- Security
- Severity: High
- CWE-1357
- OWASP A08-2021
Looks up the direct dependencies from package.json in the public npm registry and reports names that do not exist there. Scoped packages, scopes with their own registry in .npmrc and workspace repositories are left out, because a 404 there can also mean “private”.
Why this matters
AI assistants invent package names, and they do so repeatably: in a 2025 USENIX study, roughly one in five suggested names was made up, and almost half of those came back for the same prompt. Attackers exploit exactly that (“slopsquatting”): they register the invented names and publish a package with an install script under them.
As long as a name in your package.json is unclaimed, anyone can claim it — the next `npm install` on a developer machine or in CI then runs someone else's code. A failing install today is therefore not a harmless typo but an open spot in the supply chain.
Check it yourself: `npm view <package>` shows whether the package exists. If the registry answers “404 Not Found”, the name either comes from a private registry or does not exist.
Scan tier
- Repo access (deep scan)
How to fix it
Remove the name or replace it with the intended, existing package and regenerate the lock file; if the package comes from a private registry, configure it in the project's .npmrc.