Blocking hallucinated and typosquatted packages with a BeforeTool hook

[somesh-ghaturle]

Agents sometimes run pip install or npm i on package names that don't exist, and attackers register those names ("slopsquatting"), along with one-letter typos of popular packages.

I built pkg-guard, a BeforeTool hook for Gemini CLI that checks run_shell_command, write_file and replace calls before they run. It blocks packages that are missing from the registry, one edit away from a popular package, under 30 days old, or barely used, and returns the reason so the agent fixes its own command:

$ pkg-guard check "npm i lodahs"
BLOCK lodahs: looks like a typosquat of popular package 'lodash'.

It covers npm, pnpm, yarn, bun, pip, uv, poetry, cargo, gem and go, and also checks dependencies the agent writes into manifests (package.json, requirements.txt, pyproject.toml, Cargo.toml, go.mod, ...). Single Python file, stdlib only.

Setup

pipx install slopsquat-guard

// merge into ~/.gemini/settings.json
{
  "hooks": {
    "BeforeTool": [
      {
        "matcher": "run_shell_command|write_file|replace",
        "hooks": [
          { "name": "pkg-guard", "type": "command", "command": "pkg-guard hook", "timeout": 20000 }
        ]
      }
    ]
  }
}

Repo: https://github.com/somesh-ghaturle/pkg-guard
PyPI: https://pypi.org/project/slopsquat-guard/

A question for the maintainers: can a Gemini CLI extension ship a hook like this, so it installs with one gemini extensions install command instead of a manual settings merge? Feedback on false positives is welcome too.

[somesh-ghaturle]

Answered my own question: Gemini CLI extensions can ship hooks in hooks/hooks.json, so pkg-guard now installs as an extension (hook plus skill, no pipx needed):

gemini extensions install https://github.com/somesh-ghaturle/pkg-guard --ref main

The manual settings.json setup above still works if you prefer it.

[antropos17]

For false-positive feedback, I'd keep a reproducible decision table: a synthetic registry 404, a timeout, a valid newly published package, an explicitly allowlisted private name, and the same known-good package with cold/warm caches. Record the thresholds, allowlist, failure mode and cache state alongside the expected reason. That separates a policy choice or offline fallback from a heuristic regression without asking people to share private profile dumps. The registry responses can be fixtures; no real package installation is needed for that comparison.

For the manual settings merge, recording the selected settings file before and after installation also helps distinguish configuration changes from package-decision changes. I maintain AEGIS at Escape Studio: its offline Gemini user/project review and saved inventory snapshot comparison support that selected-file check. It is an MIT Windows-first beta. Confirming which hook Gemini actually loaded remains a separate runtime check.

Local security UI: 27 October 2026 source UI with simulated data; no live blocking test.

[somesh-ghaturle]

Thanks, good checklist. Most of it is already covered with fixture responses (no network) in test_pkg_guard.py: registry 404 with a "did you mean" hint, network failure (fail-open by default, fail-closed with PKG_GUARD_FAIL_CLOSED=1), too-new packages, the PKG_GUARD_ALLOW allowlist, and the cache storing only passes (blocks and failures are always rechecked).

For false-positive reports, the most useful thing is the exact command plus the BLOCK line it printed. The reason text includes the rule and threshold that fired.

Update: v0.4.3 is released, so the extension now installs without --ref main:

gemini extensions install https://github.com/somesh-ghaturle/pkg-guard

[antropos17]

Thanks for the clarification and the fixture pointer. The stated network-failure mode and pass-only cache are important context for a report; I would include the configured mode and whether a result came from cache alongside the command and rule reason, with private names redacted before posting.

I have not run pkg-guard, so this is not an independent test result. The selected-file inventory use case I mentioned stays separate from proving which extension/hook Gemini loaded and what happened to an attempted install. Thanks also for correcting the extension installation instructions.