<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-typosquatting-packages
description: >-
  Detect typosquatting and combosquatting packages across npm, PyPI, and other
  registries. Generate name permutations, check registry existence, and analyze
  package metadata for indicators of malicious intent.
domain: cybersecurity
subdomain: supply-chain-security
tags:
  - typosquatting
  - combosquatting
  - npm-security
  - pypi-security
  - package-security
  - malware-detection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Detecting Typosquatting Packages

## Overview

Typosquatting attacks publish malicious packages with names similar to popular
legitimate packages — exploiting typos (e.g., `reqeusts` vs `requests`),
transpositions, omissions, and combosquatting (`requests-utils`). This skill
generates candidate typosquat names, checks registry existence, and analyzes
package metadata for suspicious indicators like install scripts, low age, and
missing source repositories.

Mode: `[MODE: RED]` — Generate typosquat candidates; `[MODE: BLUE]` — Monitor for typosquatting attacks.

## Prerequisites

| Requirement | Details |
|---|---|
| Python 3.10+ with `requests` | Required |
| npm CLI for registry queries | Required |
| jq for JSON processing | Required |

## Key Concepts

### Name Permutation Generation

```python
# Common typosquatting techniques:
# 1. Character swap: requests → reqeusts
# 2. Character omission: requests → rquests
# 3. Character duplication: requests → rrequests
# 4. Adjacent key substitution: requests → rrquests (r→r on QWERTY)
# 5. Hyphen/underscore variants: python-dateutil → python_dateutil
# 6. Combosquatting: requests → requests-utils, requests-py
# 7. Version suffix: lodash → lodash4, lodash-v5
```

### Registry Existence Checks

```bash
# npm — check if typosquat exists
for variant in reqeusts rquests requsets; do
  result=$(npm view "$variant" version 2>/dev/null)
  if [ -n "$result" ]; then
    echo "ALERT: $variant exists on npm (version: $result)"
  fi
done

# PyPI — check via JSON API
for variant in reqeusts rquests requsets; do
  status=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/$variant/json")
  if [ "$status" = "200" ]; then
    echo "ALERT: $variant exists on PyPI"
  fi
done
```

### Suspicious Package Indicators

```bash
# Check package age (recently published = suspicious)
npm view suspicious-pkg time.created --json

# Check for install scripts (common malware vector)
npm view suspicious-pkg scripts --json | jq '.preinstall, .postinstall, .install'

# Check if repository field is missing or points to unrelated repo
npm view suspicious-pkg repository --json

# Check download count (legitimate typosquats often have low downloads)
curl -s "https://api.npmjs.org/downloads/point/last-week/suspicious-pkg" | jq '.downloads'
```

## Workflow

### Step 1: Generate Typosquat Candidates

```bash
node scripts/agent.js --action generate --package requests --output /tmp/typosquats.json
```

### Step 2: Check Registry for Matches

```bash
node scripts/agent.js --action check --package requests --registry pypi --output /tmp/found.json
```

### Step 3: Analyze Suspicious Packages

```bash
node scripts/agent.js --action analyze --package suspicious-pkg --registry npm --output /tmp/analysis.json
```

## Detection

```yaml
title: Typosquatting Packages Detection
id: 4eae8c5d-66af-469c-83d3-6d2ea93e0758
status: experimental
description: Detects suspicious activity related to detecting typosquatting packages techniques in supply chain security context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*detecting*typosquatting*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.initial_access
falsepositives:
  - Package manager performing routine dependency resolution
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Typosquatting Packages Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] Name permutations cover all common typosquatting techniques
- [ ] Registry checks run for top internal and critical dependencies
- [ ] Suspicious packages reported to registry maintainers
- [ ] CI pipeline blocks installation of known typosquats
- [ ] Monitoring configured for new packages similar to internal names
- [ ] Lock files prevent accidental typosquat resolution

## References

- [npm Typosquatting Research](https://blog.npmjs.org/post/163723642530/crossenv-malware-on-the-npm-registry)
- [PyPI Malware Checks](https://pypi.org/security/)
- [Backstabber's Knife Collection — Typosquatting Study](https://arxiv.org/abs/2005.09535)
- [MITRE ATT&CK T1195.002](https://attack.mitre.org/techniques/T1195/002/)
