Package Typosquat Checker
Check whether a package name looks like a typo of a well-known npm or PyPI package — the classic typosquatting attack pattern. Free, live, no signup.
Live check — nothing storedFrequently asked questions
What is package typosquatting?
Publishing a malicious package with a name one keystroke away from a popular one, hoping a developer mistypes 'npm install' or copy-pastes a bad example. It's one of the best-documented supply-chain attack techniques.
Why not use an exhaustive list of every package?
Typosquatting specifically targets the most famous names -- attackers want maximum accidental installs. A curated list of genuinely well-known packages covers the highest-value attack surface better than a noisy top-5000-by-downloads feed would.
What does a clean result actually mean?
It means the name isn't a close match to anything on this curated list -- it does not mean the package is safe. Pair this with a vulnerability check for known CVEs and a repo health check for the source.
Can I use this in my own code?
Yes. This page calls the same free, public API endpoint you can call directly: GET /api/typosquat-check?ecosystem=npm&package=lodas. No signup or API key required.