Typosquatting Python Packages

dnstwist

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

ail-typo-squatting

Generate list of potential typo squatting domains with domain name permutation engine to feed AIL and other systems.

taintrace

Typosquat detector for AI coding agent dependencies

ghostpkg

Catch AI-hallucinated package names before you install them

otacon

Domain impersonation detector — typosquatting, homoglyph & combosquat detection. One command, ~10s, no paid APIs.

extuno

Assess a Python package for supply-chain risk before pip installs it. Pre-install gate for pip with sandbox-backed verdicts, SARIF output and CI exit codes.

agent-police

Audit LLM API proxies and relays for tool-call tampering, dependency substitution and credential exfiltration. Implements the AC-1/AC-1.a/AC-1.b/AC-2 taxonomy from arXiv:2604.08407. Never executes what the endpoint returns.

venvy

Offline, machine-wide Python supply-chain security audit - scan every virtual environment for vulnerable & malicious packages. CVE + typosquat detection, agent/CI-ready JSON. Also a lightweight venv manager.

opensquat

openSquat is an open-source tool that detects look-alike domains impersonating your brand, by scanning newly registered domains daily.

depsweep

Supply-chain risks in npm/pip dependencies: install hooks, typosquats, insecure sources

hemlock-scan

Static supply-chain checks for npm and PyPI packages, lockfiles, provenance, and known malware.

pkgguard-cli

Vet the packages & repos your AI assistant recommended — before you install. Catches hallucinated/slopsquatted names, CVEs, malware, fake stars, and license traps in 25 languages. MCP server so the assistant checks itself. No API key.

andy-fraud

🚫 Anti-URL fraud (typosquatting) given a set of domains to check against.

dnstwist-mod

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation