InstallGate
Sample output. Same layout as the live gate. y copies, nothing installs.
Scenario
Gate
ig pip install reqeusts
Checking pip install reqeusts
✔Parse targetpypi · reqeusts · unpinned2ms
✔Registry metadataexists · first upload 2 days ago · 1 maintainer118ms
✔OSV.devno MAL- record204ms
✖Typosquat check1 edit from "requests" (top-5k list)3ms
✖PolicyP4 typosquat + new project → BLOCK1ms
✔Tavily (untrusted)0 reports in the last 30 days412ms
✔Nemotron Nano → Super3 sentences drafted1.06s
✔Validator3/3 cited · stricter-of keeps BLOCK2ms
✔Substituterequests · pinned · re-checked38ms
error[P4]: BLOCK reqeusts
pypi · risk 0.97 · verified substitute
× typosquat match and first upload under 7 days
╭─[ EV-1 hard · policy ]
╰──
× Damerau-Levenshtein distance 1 from "requests"
╭─[ EV-2 soft · pypi ]
╰──
× first upload 2 days ago · 1 maintainer
╭─[ EV-3 soft · pypi ]
╰──
× requests: exists · no MAL- record · pinned and hashed
╭─[ EV-4 info · pypi ]
╰──
note: reqeusts is one transposed letter away from requests, a top-5k package. [EV-2]
note: Its first upload was 2 days ago, by a single maintainer. [EV-3]
note: Rule P4 blocks a new package that imitates a popular name. [EV-1]
note: Validator: 3 of 3 sentences cited · 0 dropped
help: use substitute (top-5k neighbour · re-checked [EV-4])
- pip install reqeusts
+ pip install "requests==[pinned]" --hash=sha256:[pinned]
note: Not run. Confirm it, then run it yourself or let your agent run it.
note: Nemotron on Nebius Token Factory · Nano 508 tok → Super 1,390 tok · $0.00059 (all-Ultra $0.00251, −76%) · Tavily 1 call · 1.84s
? Run `pip install "requests==[pinned]" --hash=sha256:[pinned]` [y/N]
ig