Registry metadata for an npm, PyPI or crates.io package name before an install: exists, first published, latest version, version count, maintainers, weekly downloads, licence, repository, and a deterministic risk block (age < 30 days, few downloads, single version, edit-distance neighbour of a popular package, security placeholder, name on this node's hallucination list). Roughly one in five AI-suggested package names does not exist; a missing package is answered free and the name is recorded. Metadata only, never a tarball.