typosquatting
Safeguard articles tagged "typosquatting" — guides, analysis, and best practices for software supply chain and application security.
65 articles
The Twenty-Minute Review to Run Before You Add a Dependency
Adding a dependency takes ten seconds and commits you to trusting a stranger's code on your build machines for as long as the project lives. Six checks, the signals that should stop you, and what this deliberately does not defend against.
The Moment a Malicious Package Actually Costs You Something
By the time a scanner flags a malicious package, its install script may have already run. Package Firewall intercepts npm and pip installs before that happens.
Typosquatting in open source package registries explained
Typosquatting hides malware behind a one-character package name typo. Learn how it works, real incidents, and how to detect it before your build runs.
Seventeen Fake Payment SDKs, Six Minutes to Detection, and a Sandbox Check
On 7 July 2026, roughly 17 typosquatted payment-provider packages hit npm and PyPI — paysafe-checkout, paysafe-node, neteller and friends. They swept environment variables matching KEY, SECRET, TOKEN, PASS, AUTH and API, explicitly hunted AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN and NPM_TOKEN, and exited quietly if they thought they were in a sandbox.
Go module proxy vulnerability trends
A backdoor hid in Go's module proxy for 3+ years, and 63,000+ orphaned packages remain cached. Inside 2025's Go supply chain reckoning.
npm Malware Today: The Current Threats and How to Stay Safe
npm malware today means self-spreading worms, infostealers, and typosquatted packages that run on install. Here is what the current campaigns look like and how to defend your builds.
Malicious Go modules found on GitHub
Malicious Go modules keep surfacing on GitHub, exploiting the ecosystem's lack of a curated registry. Here's the pattern — and how to defend against it.
Docker Hub typosquatting of official images
Attackers are cloning popular Docker Official Images under lookalike names, tricking `docker pull` into fetching malware instead of trusted base images.
Malicious NuGet packages targeting .NET developers
A fresh wave of malicious NuGet packages is hitting .NET developers via typosquatting, MSBuild-triggered code, and IL weaving. Here's what's happening and how to respond.
The Cursor extension that cost a developer $500,000
A fake Solidity extension on Open VSX was downloaded 50,000+ times, dropped an infostealer, and drained $500K in crypto — how the marketplace trust model failed.
Do Not Pass GO: Malicious Golang Package Alert
A typosquat of boltdb/bolt stayed cached on Go's module proxy for roughly three years after its source repo was cleaned up — proxy caching beats takedowns.
npm package aliasing: the dependency confusion attack surface most teams never scan
npm's alias@npm:target syntax lets an attacker capture a name that doesn't even exist yet on the registry — widening dependency confusion past simple squatting.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.