Block hallucinated dependencies before they install.

CI gate: registry resolve + allowlist. Engineering findings, not an SCA suite.

Install the Action

# .github/workflows/phantomdep.yml
name: PhantomDep Gate
on: [pull_request]
permissions:
  contents: read
  pull-requests: write
jobs:
  gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: 231Labs/phantomdep@main

Fail-closed on npm names missing from the registry. Optional .phantomdep-allowlist overrides a miss after human verify. Week-1 = block only.

Private-repo seats

Test seat price is configured via env. Checkout stays in Stripe test mode. No live Stripe keys until Al unlocks.