Hi, I built RepoXray (https://github.com/Ra9mirez11/repoxray) to audit repositories before running npm install or attaching AI coding agents.

Why I built it:

  1. AI slopsquatting: LLMs regularly hallucinate plausible package names. If a package returns 404 on npm today, an attacker can register it tomorrow. RepoXray checks live registry existence, package age (<21 days), OSV.dev advisories (resolving exact package-lock.json versions), and risky postinstall shell/network hooks.
  2. MCP & .env exposure: Many repos now include .mcp.json or claude_desktop_config.json with plaintext tokens or unpinned npx -y remote execution, plus .env files readable by coding agents without .aiignore.
  3. Privacy & footprint: The web scanner runs 100% in browser RAM via File System Access / Drag-and-Drop APIs (0 bytes uploaded to any server). The CLI (npx rxray .) is a 19 KB bundle with 0 runtime dependencies.

It also calculates active LLM context bloat and compiles tailored .aiignore + AGENTS.md guardrails and a remediation prompt. Would appreciate technical feedback on false positives or missing detection rules.