domains / families / security / detecting-typosquatting-packages-in-npm-pypi

detecting-typosquatting-packages-in-npm-pypi

separate

'Detects typosquatting attacks in npm and PyPI package registries by

When to use

• Auditing project dependencies to identify packages whose names are suspiciously similar to popular libraries
• Proactively scanning package registries for newly published packages that may be typosquats of your organization's packages
• Investigating a suspected supply chain compromise where a developer installed a misspelled package name
• Building automated monitoring that alerts when new packages appear with names close to critical dependencies
• Assessing the risk profile of unfamiliar packages before adding them to a project's dependency tree

When not to use

• sole determination of malicious intent
• bulk automated takedown requests without manual review
• use against private registries without authorization

Skill page

Source