Add sloppy-joe — multi-ecosystem dependency supply chain security

[brennhill]

Summary

Adds sloppy-joe to the static analysis tools list.

sloppy-joe is a supply chain security tool that detects hallucinated, typosquatted, and non-canonical dependencies before they reach production.

Key features

• 11 mutation generators for typosquatting detection (homoglyphs, separators, vowel swaps, prefix/suffix attacks, etc.)
• AI hallucination detection — catches non-existent packages that LLMs confidently recommend
• Live registry verification across 8 package ecosystems: npm, PyPI, Cargo, Go modules, RubyGems, Packagist, Maven/Gradle, NuGet
• OSV vulnerability checking for known CVEs
• Three-tier dependency classification — internal, allowed, and checkable deps with configurable policies
• Designed as a CI gate for supply chain security

Why this matters

As AI-assisted coding becomes mainstream, a growing category of supply chain attacks exploits LLM hallucinations — packages that don't exist get recommended by AI, then attackers register those names with malicious payloads. sloppy-joe was built specifically to catch this class of attack alongside traditional typosquatting.

• License: Apache-2.0
• Written in: Rust
• Category: Linter (security / dependency checking)

[mre]

Sorry this was closed automatically. Sloppy Joe is close enough to the age threshold and meets the other criteria, so I reopened it. Please add the ai-generated-code tag.

Edit: in fact I noticed that there's just a single contributor for now, so let's hold off on merging for a little longer. You can, however, already add the tag I mentioned.