AI-detected possible typosquat

Information

The "AI-detected possible typosquat" alert distinguishes AI-flagged typosquat threats from those which have undergone human review, similar to our existing AI-detected alerts for other threat types. It carries a Medium severity, whereas the Possible typosquat attack alert is flagged as Critical.

Typosquatting continues to be a serious attack vector, and we are evolving our detection capabilities to identify these threats faster and more reliably. This malicious practice occurs when attackers create packages with names that are intentionally similar to popular, legitimate packages. These packages often have slight variations in spelling, capitalization, or punctuation. The goal is to trick developers into accidentally installing the malicious package instead of the intended one, thereby compromising the security of their projects.

The concern with typosquats is that they can introduce significant security risks to your project. Once installed, a typosquatting package can execute malicious code, steal sensitive information, or create backdoors for future attacks. Because these packages are designed to closely resemble legitimate ones, they can easily go unnoticed, leading to potential widespread impact.

Recommended actions

Verify the Package Name:

• Double-check the spelling of the package name in your package.json file. Ensure that it matches the intended package exactly, including the correct case.

Confirm the Package Source:

• Visit the npm registry page of the suspected package to verify its legitimacy. Look for signs of trust, such as the number of downloads, reviews, and activity in the repository.

Compare with Known Packages:

• Compare the suspect package with the legitimate package you intended to use. Pay attention to details like the maintainer, version history, and repository links.

Check for Similar Names:

• Investigate if there are other packages with similar names. Typosquatting often involves creating packages with names that are very similar to popular packages.

Remove Malicious Packages:

• If you find that a malicious package was included in your code base, remove it immediately.

Replace with the Correct Package:

• If you identify that the package is indeed a typo, replace it with the correct package name in your package.json file.

Examples

Here's an example of an AI-detected possible typosquat alert:

The alert details include the alternate package that is potentially being typosquatted. In cases where you receive this alert, it's a good idea to double check the package you're intending to install to ensure it is the legitimate one.

Detection Method

The heuristic for this alert is similar to the Possible Typosquat Attack alert. Socket fetches package with names similar to the target package, focusing on those with significantly higher download counts. It sorts these packages to prioritize the most likely typosquats, calculates the probability of each package being a typosquat, and flags packages if their probability exceeds a certain threshold.

Additional resources

• How Socket Combats Insidious Typosquatting Supply Chain Attacks
• 2016 Research: Typosquatting in Programming Language Package
  Managers
• Beyond Typosquatting: An In-depth Look at Package Confusion