npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
- Auditing project dependencies to identify packages whose names are suspiciously similar to popular libraries
Detects typosquatting in npm and PyPI packages using Levenshtein distance, publish date checks, and download anomalies. Queries registry APIs to compare metadata against watchlists.
Simulates and detects PyPI supply chain attacks including typosquatting via Levenshtein distance, dependency confusion against private registries, pip package hash verification, and pip-audit vulnerability scanning.
Detects PyPI supply chain attacks including typosquatting via Levenshtein distance, dependency confusion for private registries, pip SHA-256 hash verification, and pip-audit CVE scanning. Outputs JSON risk reports.
Share bugs, ideas, or general feedback.
Do not use as the sole determination of malicious intent; name similarity alone does not prove a package is malicious. Do not use for bulk automated takedown requests without manual review of flagged packages. Do not use against private registries without authorization.
requests and python-Levenshtein (or rapidfuzz) packages installedhttps://pypi.org/pypi/<package>/json (PyPI JSON API) and https://registry.npmjs.org/<package> (npm registry API)Establish the set of legitimate packages to monitor for typosquats:
requirements.txt, Pipfile.lock, package.json, or package-lock.json to extract all direct and transitive dependency nameshttps://hugovk.github.io/top-pypi-packages/) or top npm packages by download countre.sub(r"[-_.]+", "-", name).lower()). npm package names are case-sensitive but scoped packages use @scope/name format. Normalize before comparison.Produce potential typosquat variants for each target package:
requests -> rquests, requets, reqests)requests -> erquests, rqeuests, reques ts)requests -> rrquests, requesta)requests -> rrequests, reqquests)my-package -> mypackage, my--package, my_package)python-requests, requests-python, requests2, requests-lib)Check whether generated candidate names actually exist in the registry:
GET https://pypi.org/pypi/<candidate>/json for each candidate. A 200 response means the package exists; 404 means it does not. Extract from the response: info.name, info.version, info.author, info.summary, info.home_page, info.project_urls, and releases (keyed by version with upload_time_iso_8601 timestamps).GET https://registry.npmjs.org/<candidate> with Accept: application/json. Extract: name, description, dist-tags.latest, time.created, time.modified, maintainers, and versions.429 when rate limited; implement exponential backoff.requests.Session) and limit concurrency to avoid triggering abuse protections.Score each existing candidate package against multiple heuristic signals:
pypistats.org/api/); npm provides download counts at https://api.npmjs.org/downloads/point/last-week/<package>.Combine signals into a composite risk score and generate an actionable report:
| Term | Definition |
|---|---|
| Typosquatting | Registering a package name that closely resembles a popular package, exploiting common typos to trick developers into installing malicious code |
| Levenshtein Distance | The minimum number of single-character edits (insertions, deletions, substitutions) required to transform one string into another; the primary metric for measuring name similarity |
| Dependency Confusion | A broader supply chain attack where attackers publish malicious packages to public registries with names matching private internal packages, exploiting package manager resolution order |
| PEP 503 Normalization | The Python packaging specification that treats hyphens, underscores, and periods as equivalent in package names, meaning my-package, my_package, and my.package resolve to the same package |
| QWERTY Distance | A keyboard-layout-aware distance metric measuring how far apart two keys are on a standard keyboard, used to detect substitutions from adjacent key mistyping |
| Combosquatting | A variant of typosquatting where attackers prepend or append common words to a package name (e.g., requests-security, python-requests) |
| StarJacking | An attack where a typosquat package links its repository URL to the legitimate package's GitHub repository to inflate apparent credibility |
https://pypi.org/pypi/<package>/json returning package metadata including name, author, versions, upload timestamps, and project URLshttps://registry.npmjs.org/<package> returning package metadata including maintainers, version history, creation timestamps, and distribution infohttps://api.npmjs.org/downloads/point/<period>/<package> providing download statistics for npm packagesContext: A security team discovers that a developer's workstation was compromised after installing a Python package. The incident response team needs to audit all project dependencies for potential typosquats and establish ongoing monitoring.
Approach:
requirements.txt and Pipfile.lock to extract all 87 direct and transitive dependenciessecurity@pypi.org, and add all 87 dependencies to the ongoing monitoring watchlistPitfalls:
@scope/name) which have different naming rules than unscoped packages## Typosquatting Detection Report
**Scan Date**: 2026-03-19
**Registry**: PyPI
**Packages Monitored**: 87
**Candidates Generated**: 2,412
**Candidates Found in Registry**: 34
**Flagged as Suspicious**: 5
### HIGH Risk (Score >= 70)
| Suspect Package | Target Package | Levenshtein | Created | Downloads | Score |
|----------------|---------------|-------------|---------|-----------|-------|
| reqeusts | requests | 1 | 2026-02-28 | 43 | 92 |
| requsets | requests | 1 | 2026-03-01 | 12 | 88 |
| numpyy | numpy | 1 | 2026-01-15 | 67 | 78 |
### Recommendation
- BLOCK: reqeusts, requsets, numpyy (add to artifact proxy deny-list)
- REPORT: Submit malware reports to security@pypi.org with package names and evidence
- MONITOR: Continue weekly scans for the full dependency watchlist