attester-verify-packages — GitHub Copilot rule: package checks
Checks PyPI and npm package and symbol names through attester.dev before installation or import. It helps keep invented dependencies out of code.
.github/instructions/attester-verify-packages.instructions.mdWhat attester-verify-packages does
This rule tells GitHub Copilot to verify third-party packages before adding them to requirements.txt, pyproject.toml, or package.json, and before writing import, require, or an unconfirmed library symbol. The check uses published PyPI and npm artifacts instead of model memory. Standard-library modules, local project modules, and names already checked in the session can be skipped.
Package checks use POST requests to https://attester.dev/demo/v1/package/exists; symbol checks use https://attester.dev/demo/v1/symbol/exists. The service needs no account or API key, but the free route allows 25 calls per day per client IP. On HTTP 429 or a network failure, the rule reports why the check was skipped and chooses a conservative path with a known package and pinned version. A name marked typosquat_adjacent: true must not be installed.
What it helps with
- verify a PyPI package before adding it
- check an npm package before installation
- confirm a library symbol before importing it
- investigate a missing-package or missing-symbol build error
- catch a typo or invented dependency name
Example prompts for the agent
- Before adding a dependency to
requirements.txt, check that the PyPI package exists. - Verify that this symbol exists in the npm package before importing it.
- The build failed on a missing module. Check the package name and suggest a real match.
How to install attester-verify-packages
Manually: put the files in place
.github/instructions/attester-verify-packages.instructions.mdThe applyTo field sets which files it applies to
Manually: put the files in place
.claude/rules/attester-verify-packages.mdThe paths frontmatter field limits the files: move applyTo from the source into paths
AGENTS.md
Codex reads AGENTS.md: paste the rule text there
Manually: put the files in place
.cursor/rules/attester-verify-packages.mdcFrontmatter: description, globs, alwaysApply. Move applyTo from the source into globs, or the rule will not attach on its own
Manually: put the files in place
.devin/rules/attester-verify-packages.mdManually: put the files in place
.clinerules/attester-verify-packages.mdStep by step, with commands for each platform: AGENTS.md vs CLAUDE.md: what they are and which one to use
Questions about attester-verify-packages
How do I install attester-verify-packages in GitHub Copilot?
Add the rule file at .github/instructions/attester-verify-packages.instructions.md.
What does attester-verify-packages do?
It checks PyPI and npm packages and symbols through attester.dev before installation, import, or use. A negative result blocks the name and returns nearby matches.
Does the check require an API key?
No account or API key is needed. The free route allows 25 calls per day per client IP.
Source text
attester-verify-packages.instructions.md · MIT
---
description: 'Verify PyPI and npm package and symbol names against the attester.dev existence oracle before installing or importing, so hallucinated dependencies never reach code'
applyTo: '**'
---
# Verify packages before installing or importing
Use the attester.dev existence oracle before adding any third-party dependency or calling a library symbol you cannot confirm exists. The oracle answers from real published artifacts (PyPI wheels, npm tarballs), not from model memory.
This instruction exists because models invent plausible package names: a USENIX Security 2025 study measured 5.2% to 21.7% of suggested package names as nonexistent, depending on model and ecosystem.
## When to check
- Before adding a package to a dependency file (`requirements.txt`, `pyproject.toml`, `package.json`) or running an install command for a package you did not choose yourself.
- Before writing an `import`, `require`, or `from ... import` for a third-party package.
- Before calling a function, class, or constant you cannot confirm exists in the target package.
- When a build fails on a missing package or symbol: check the name before changing anything else.
Skip the check for standard library modules, local project modules, and names already verified this session.
## How to check
Free keyless endpoint, no account or API key. Quota: 25 calls per day per client IP, reset 00:00 UTC.
1. Package check: POST `https://attester.dev/demo/v1/package/exists` with body `{"ecosystem": "pypi" | "npm", "name": "<name>"}`. Proceed only when `exists` is `true`.
2. Symbol check: POST `https://attester.dev/demo/v1/symbol/exists` with body `{"ecosystem": "pypi" | "npm", "package": "<package>", "symbol": "<symbol>"}`. On a miss, prefer the `closest_match` suggestions over inventing variants.
On HTTP 429 (daily quota spent) or on network failure: state that the check was skipped and why, then continue with the most conservative option (prefer well-known packages and pinned versions).
## What to do with answers
- `exists: true`: proceed. When pinning, prefer the version in `latest_version`.
- `exists: false`: do not install or import. Report the negative to the user together with the oracle's closest real names (`adjacent_to`, `closest_match`) and ask which one was meant.
- `typosquat_adjacent: true`: treat as a strong signal that the name is a typo or a hallucination. Never install the flagged name.
## Higher volume
The free tier covers normal editing sessions. A paid route without the daily cap exists for high-volume use; see the service docs for details.
© github · MIT · github/awesome-copilot
