All projects matching “typosquat”

Score a URL for phishing risk before an agent opens or trusts it. Keyless, deterministic heuristics - typosquat / homoglyph of a known brand, punycode / mixed-script hosts, credentials-in-URL, raw-IP hosts, suspicious TLDs, over-deep subdomains - plus a best-effort domain-age check (young domains are a top phishing signal). Returns a 0-100 risk score, a SAFE / SUSPICIOUS / DANGEROUS verdict, and l

Call before an agent runs npm install. Checks one npm package against the registry, OSV advisories, install scripts, typosquat and combosquat names and repository provenance, and flags hallucinated or slopsquatted names. Answers safe, caution, block or does_not_exist; every reason is sourced and labelled fact or heuristic.

Checks whether a URL/domain is safe to fetch, cite, or follow: flags phantom-squatted or typosquatted brand domains, unregistered or brand-new domains, and known malicious infrastructure (URLhaus). Returns an ALLOW/WARN/BLOCK verdict before your agent trusts the link.

Package security scanner — CVEs, license check, typosquat detection.

Before an AI coding agent (or you) runs a GitHub repo's install steps: scans README, package.json install scripts, install.sh/setup.py, .vscode/tasks.json and Makefile for download-and-execute one-liners (iwr|iex, curl|sh), obfuscated or base64 payloads, known malware domains, typosquatted crypto dependencies, agent-targeted prompt injection and password-protected archives, plus GitHub signals of

Phishing / impersonation check for crypto links before an agent or person connects a wallet or signs: brand lookalikes & typosquats of 60 wallets/exchanges/dapps, punycode, domain age (RDAP), DNS, redirects, and a page scan for seed-phrase prompts and approval-drainer code. 1-10 URLs per call.

Typosquat and quality signals for an npm package before installing it: weekly downloads, latest version, license, deprecation notice, repository link, and computed risk flags (low_downloads, deprecated, no_repository, no_license, not_found). A package with 12 weekly downloads pretending to be a popular library is the classic supply-chain attack on coding agents. Pairs with the package-vulns endpoi