The attack vector: AI assistants hallucinate package names → attackers register those names with malware → developers install malware thinking it's legit.
How it works: 1. Checks if packages exist on registries 2. Matches against 10+ AI hallucination patterns 3. Detects typosquats of top 3000 packages 4. Analyzes metadata (age, downloads, maintainers)
``` pip install phantom-guard phantom-guard validate flask-gpt-helper # HIGH_RISK: Package not found, matches pattern ```
Performance: <10ms cached, <200ms uncached.
Try the live demo: https://matte1782.github.io/phantom_guard/