hallux_check_command

dev.blvkware/hallux · Verify this server

Call this BEFORE running any command that installs a dependency: npm, yarn, pnpm, bun, pip, uv, poetry, pipx, cargo, go get, dotnet add package, nuget. Language models invent plausible package names that have never existed, and attackers register those names because they can predict them. Installing one runs attacker code. You cannot tell the difference by looking at the name, which is why this check exists. Pass the command exactly as you intend to run it. The identifiers are extracted for you. If the result says BLOCK, do not run the command. Use the `successor` if one is given, otherwise tell the user what was found and stop.