{"uid":"cap_cuxKvJdmTRYjv0tNGvWXR","slug":"dependency-trust-typosquat-lookalike-checker-916bcc92","name":"Dependency Trust – Typosquat Lookalike Checker","description":"Should your agent install this package? Vulnerabilities, license, age, popularity, provenance, typosquat lookalikes and a trust score for npm, PyPI, crates.io, Go and Maven, in one call. Pay per call over x402, no API key.","url":"https://dep-trust.agent-utils.workers.dev/v1/typosquat","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ecosystem","name"],"properties":{"name":{"type":"string","description":"Package name (npm scoped names allowed; Maven as groupId:artifactId; Go as module path)"},"ecosystem":{"enum":["npm","pypi","cargo"],"type":"string"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"name":{"type":"string"},"ecosystem":{"enum":["npm","pypi","cargo","go","maven"],"type":"string","description":"Package ecosystem"},"isPopular":{"type":"boolean"},"lookalikes":{"type":"array","items":{"type":"object"}},"suspicious":{"type":"boolean"},"popularRank":{"type":["integer","null"]}}}}}}},"responseSchema":{"type":"json","example":{"name":"lodahs","ecosystem":"npm","isPopular":false,"lookalikes":[{"kind":"edit-distance","name":"lodash","rank":34,"distance":1}],"suspicious":true,"popularRank":null}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_aFxgCDGY-zvbvZ2KSJTFY","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Detects typosquatting lookalikes for a given package name on npm, PyPI, or crates.io by returning edit-distance similar popular packages and a suspicion flag.","exampleAgentPrompt":"Before I install it, can you check if the npm package 'lodahs' looks like a typosquat of any popular packages?","exampleUseCases":[{"title":"Pre-install supply chain check","prompt":"I'm about to install the PyPI package 'requets' in my project — can you check if it's a typosquat lookalike of something popular before I add it to my dependencies?"},{"title":"CI pipeline dependency vetting","prompt":"In our CI pipeline, flag any suspicious packages before they get installed — can you check if the cargo crate 'serd' is a typosquatting attempt on a well-known crate?"},{"title":"Security audit of unknown package","prompt":"We got a pull request adding 'coloers' as an npm dependency — check if that package name is suspiciously close to any popular npm packages and tell me if it's flagged as a lookalike."}],"resultDescription":"Returns a JSON object with the queried package name, ecosystem, whether it is popular, its popularity rank (or null), an array of lookalike packages (each with kind, name, rank, and edit distance), and a boolean 'suspicious' flag indicating whether the name appears to be a typosquat.","failureModes":["Unknown ecosystem returns validation error — only npm, pypi, cargo are currently supported","Package name not found returns empty lookalikes array with suspicious:false — not an error, just no matches","Missing required query parameters (name or ecosystem) returns a 400-level error","Rate limiting or payment failure via x402 may block requests if USDC payment is not properly attached","Very new or extremely obscure packages may lack popularity rank data, returning popularRank:null"],"whenToPreferThis":"Use this endpoint when you specifically need to detect whether a package name is a typosquatting lookalike of a popular package — ideal for pre-install checks, CI/CD pipeline security gates, or security audits of unfamiliar dependencies. Prefer this over general vulnerability scanners when the primary concern is supply-chain name-spoofing attacks rather than CVEs or license issues. Best for npm, PyPI, and cargo ecosystems.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T18:32:56.943Z","isFirstParty":false}