RepoXray: open-source scanner flags slopsquatting risks and secret leaks before npm install

What RepoXray does

A developer posting as ramirez911 has released RepoXray, an open-source utility that inspects a codebase at two increasingly risky moments: right before running npm install, and right before attaching an AI coding agent to the repository. Announced in a Show HN-style post on dev.to, the project is available both as a browser-based scanner and as a CLI invoked with npx rxray ., and it concentrates on threat patterns that have emerged alongside AI-assisted development.

Detecting slopsquatting before you install

The tool's headline target is "slopsquatting," a play on typosquatting that exploits how language models invent dependencies. When an LLM generates code, it sometimes produces plausible-sounding package names that do not actually exist on npm. An attacker who notices such a hallucination can register the name and publish malicious code under it, catching every developer — or autonomous agent — who later installs the invented dependency.

According to the dev.to announcement, RepoXray checks several signals for each dependency in a project:

• Whether the package currently exists on the live npm registry, catching names that only exist in generated code
• Package age, flagging anything published less than 21 days ago as higher risk
• Known vulnerabilities from OSV.dev, resolved against the exact versions pinned in package-lock.json rather than loose semver ranges
• Install lifecycle scripts, specifically postinstall hooks that execute shell commands or open network connections during installation

MCP configs and agent-readable secrets

The second focus is a class of exposure that traditional secret scanners were not designed around. As the author explains, repositories increasingly ship an .mcp.json or claude_desktop_config.json alongside the code, and these files sometimes contain plaintext tokens for model context protocol servers or remote tools. Others include unpinned npx -y invocations, which download and execute code from the network each time the configuration is attached to an agent.

RepoXray also looks for .env files that a coding agent can read when the repository lacks an .aiignore file excluding them — a subtle gap, since developers may have added such files to .gitignore long ago without considering that an agent with filesystem access behaves differently from a human collaborator.

Nothing leaves the machine

The privacy claim is central to the design. The web version of the scanner runs entirely in browser memory using the File System Access and drag-and-drop APIs, with zero bytes uploaded to any server — a meaningful property for a tool whose whole job is to look at your secrets. The CLI is a 19 KB bundle with no runtime dependencies, which matters because a supply-chain auditor is itself a dependency you are pulling in; a minimal install surface reduces the odds of the scanner becoming the attack vector it exists to prevent.

Context bloat and generated guardrails

Beyond security, the tool estimates active LLM context bloat in a repository and compiles a tailored .aiignore and AGENTS.md pair, plus a remediation prompt describing suggested fixes. The framing is that a leaner, better-bounded repository is both cheaper to run against a model and less likely to leak incidental files into an agent's working context.

Why it matters

The project lands at the intersection of two trends. First, AI code generation has created a new supply-chain vector: hallucinated package names are a scalable, low-cost target for attackers, and slopsquatting extends typosquatting from human typos to machine output. Second, agentic workflows have quietly expanded the attack surface of an ordinary repository, adding plaintext-credential MCP configs, remote-execution-by-default tool invocations, and agent-readable environment files to the classic concerns of dependency compromise.

A checkpoint that runs before install and before agent attachment is a sensible place for controls, and a local-only scanner avoids the irony of uploading your secrets to hunt for leaked secrets. The obvious caveat is maturity: the project is new, and the effectiveness claims come from its author, who explicitly asks the community for feedback on false positives and missing detection rules. Treat it as an early-stage tool worth evaluating — and one that signals a category of pre-agent security tooling likely to keep growing.