domains / families / security / detecting-typosquatting-packages

detecting-typosquatting-packages

separate

Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation, using edit-distance, keyboard-proximity, and known-target corpus matching with typomania, Microsoft OSSGadget's oss-find-squats, and pypi-scan. Use before adding a new dependency, as a CI/CD gate on pull requests, when reviewing an AI-generated ("slopsquatting") dependency list, or when auditing a lockfile diff for a swapped package.

When to use

• Before adding a new dependency to `package.json`, `requirements.txt`, `pyproject.toml`, or `Cargo.toml`
• As a CI/CD gate that screens every newly introduced dependency name in a pull request
• When triaging an AI-generated or tutorial-sourced dependency list ("slopsquatting" review)
• During security review of a lockfile diff to catch a swapped or newly-pinned squat
• When building a registry-side or proxy-side guardrail that blocks installs of suspected squats

When not to use

• mass automated registry scraping

Skill page

Source