| name | typosquat-check |
| description | Typosquat and malicious-package detection across installed dependencies (or a single prospective addition) — cross-checks AI-malware family intelligence, package-name similarity to known popular packages, low maintainer-health signals. Use when auditing a freshly-onboarded repo, vetting a single suspicious package, gating CI on supply-chain risk, or investigating an incident. |
| argument-hint | [<package-name>] | [--installed] |
| user-invocable | true |
| allowed-tools | Bash, Read, Glob, Grep, Edit, Write |
| model | sonnet |
| triggers | ["typosquat","malicious package","supply chain","typo squatting"] |
| chain | ["dep-add-guard"] |
| outputBudget | short |
| cooldown | per-session |
Vulnetix Typosquat Check Skill
Use when
- Onboarding: scan all installed deps for typosquat/malware matches.
- Vetting a single package that looks suspicious (
react-utill, lodash-utility, etc.).
- CI gate: block any installed dep flagged BLOCK.
- Post-incident: cross-reference your installed deps against newly-discovered malware families.
- Investigating a single package after a vendor advisory mentions name-similarity attacks.
Don't use for
- CVE-based vulnerability scanning — use
/vulnetix:sca-scan.
- Generic package risk before adding — use
/vulnetix:dep-add-guard.
- Detecting compromised packages via runtime behaviour — Pix is static-only.
Conventions
This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.
Step 1: Decide mode
- Single-package:
$ARGUMENTS is a name → check just that.
--installed: read lockfile (per derived.primary_package_manager), check every direct dep.
Step 2: Run gated scan + AI-malware lookup
vulnetix scan --block-malware -o json
vulnetix vdb ai-malware list -o json | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/ai-list.jq"
vulnetix vdb packages search "$PACKAGE" --ecosystem "$ECO" -o json
The packages search response includes typosquat-similarity scores against well-known package names.
Step 3: Render
| Package | Version | Verdict | Reason |
| react-utill | 1.0.0 | BLOCK | typosquat of react-util (similarity 0.92), 0 stars, 14d old |
