ailint — static linter for AI-generated code

AI coding tools hallucinate. ailint catches it before production.

$ npx @ailint/cli check .

  src/hallucinated-packages.ts
    ✗ fetch-retry-plus :2
      Package "fetch-retry-plus" not found in lockfile or node_modules
    ✗ next-api-helpers :3
      Package "next-api-helpers" not found in lockfile or node_modules
    ✗ react-server-hooks :4
      Package "react-server-hooks" not found in lockfile or node_modules

  src/phantom-apis.ts
    ✗ zod.ZodBrand :2
      "ZodBrand" is not exported by zod
    ✗ zod.createValidator :2
      "createValidator" is not exported by zod
    ✗ commander.Router :3
      "Router" is not exported by commander

  6 errors (3 files, 50ms)
  ✗ Check failed

Why

AI agents hallucinate at scale:

• 21.7% of package names suggested by open-source models don't exist on npm (Liang et al., 2024)
• At least 5.2% from commercial models (GPT-4, Claude) — same study
• 58% of hallucinations are repeatable, making them exploitable (slopsquatting)
• Agents use deprecated APIs from stale training data (source)

ESLint checks style. TypeScript checks types. ailint checks reality.

Install

npx @ailint/cli check .          # zero install
npm install -g @ailint/cli       # or install globally

What it detects

1. Hallucinated packages

Imports from packages that don't exist in your lockfile or node_modules.

// AI wrote this — fetch-retry-plus doesn't exist on npm
import { fetchWithRetry } from 'fetch-retry-plus';

✗ fetch-retry-plus :1
  Package "fetch-retry-plus" not found in lockfile or node_modules

2. Phantom APIs

Imports of functions/classes that don't exist in the installed version.

// AI confused zod with another library
import { z, ZodBrand, createValidator } from 'zod';

✗ zod.ZodBrand :1
  "ZodBrand" is not exported by zod
✗ zod.createValidator :1
  "createValidator" is not exported by zod

3. Not-installed packages

Packages in your lockfile but missing from node_modules (needs npm install).

⚠ express :1
  Package "express" is in lockfile but not installed. Run npm install.

How it works

100% static analysis. No LLM. No network calls (by default). No config.

1. Walks your source files (.ts, .tsx, .js, .jsx)
2. Extracts all imports via TypeScript compiler API
3. Checks each package against lockfile + node_modules
4. Verifies each imported symbol against the package's .d.ts exports
5. Reports issues with file, line, package, and symbol

Sub-100ms on real projects. Zero dependencies beyond Node.js and TypeScript.

CI / GitHub Action

- name: Lint AI-generated code
  run: npx @ailint/cli check src/ --format json

Exit code 1 on errors, 0 on clean. Use --format json for machine-readable output.

Options

ailint check [dir]              Scan for AI code issues (default: .)

  -f, --format <format>         pretty | json (default: pretty)
  --online                      Check npm registry for unknown packages
  --ignore <pattern>            Glob patterns to exclude (repeatable)
  -q, --quiet                   Only show errors, suppress warnings
  --no-color                    Disable colors

What ailint does NOT do

| Tool | Checks | ailint overlaps? | |---|---|---| | ESLint | Code style, patterns | No | | TypeScript | Type correctness | No | | npm audit | Known vulnerabilities | No | | ailint | Package existence, API existence | This is the gap |

Try the demo

git clone https://github.com/lucianfialho/ailint-cli
cd ailint-cli
npm install
npx tsx src/index.ts check examples/demo-project

License

MIT