phantom-deps scans AI-generated code for hallucinated packages

A developer released phantom-deps, a tool that checks requirements.txt, pyproject.toml, package.json and bare imports against the real PyPI and npm registries. It follows USENIX Security 2025 research showing 19.7% of 2.23 million package references from 16 LLMs pointed to never-published packages.

• 19.7% of package references from 16 LLMs pointed to unpublished packages
• Tool flags PHANTOM (not in registry) and NEW (published under 30 days ago)
• Runs on the Python standard library with zero dependencies and local caching
• Exit code 1 on findings makes it usable in CI and pre-commit hooks