Verify a single npm or PyPI package before installing, importing, or recommending it. Returns whether it actually exists, and flags slopsquatting (a low-adoption package impersonating a popular one), names npm removed for malware, install-time scripts, deprecation, and abandonment. Call this whenever you are about to introduce a dependency you have not verified in this session. Read-only; one or two requests to the public registry. A verdict of UNKNOWN means the registry did not answer — retry, never assume safe.

Verify many npm or PyPI packages at once — use this before writing a package.json or requirements.txt, or handing a dependency list to a user. All names must belong to one ecosystem per call. Results are sorted worst-first so anything hallucinated or dangerous surfaces at the top. Read-only; batches registry requests and caches adoption figures, so 50 names take a few seconds.

Verify the packages a shell command would install or execute, before running it: npm install …, npx …, pnpm add, yarn add, bun add, pip install, uv add, poetry add and similar, including behind sudo, && chains and sh -c. Extracts the package names (npm and PyPI at once), checks each against its registry, and returns them worst-first. A command that installs nothing by name (a bare npm install from a lockfile, git, npm test, or npx <bin> of a tool already in node_modules) returns total 0 and costs no network call — use check_dependencies on the manifest in that case. Read-only.