Package Typosquatting Checker

Check a dependency name against the popular packages it could be a typo of - edit distance, confusable characters, separator swaps - before you install it.

Uses an external data source

Your search term is sent to the public authority named on this page so the answer reflects current data.

Data source: npm and PyPI registries (optional lookup)

Ecosystem npm PyPI

Package names to check, one per line Compared in your browser against the most popular package names. Nothing is sent unless you choose the registry lookup below.

The name you almost typed

Typosquatting puts a malicious package on a public registry under a name one keystroke away from a popular one: crossenv for cross-env, lodahs for lodash, a Cyrillic а inside react. Install scripts run the moment the package is installed, so a single slip in a package.json or a pip install is enough. This checker tests a name before you install it.

What it looks for

Lookalike characters from other scripts that render like Latin letters.
Digits standing in for letters (l0dash).
Separator games: hyphens, underscores and dots added, dropped or swapped.
npm scope tricks: types-node for @types/node.
Combosquatting: a popular name with -js, node- or -cli attached.
Single-edit typos: dropped, added, doubled, swapped or substituted characters. Two edits are allowed for names of ten characters or more.

Each match names the popular package it resembles, its popularity rank and the exact technique, so you can judge it yourself.

Heuristics, clearly labelled

A resemblance is a reason to look closer, not proof of malice. Plenty of legitimate packages have names near popular ones. Equally, a name that matches nothing is not thereby safe: it only means it does not resemble a popular package. To keep false positives down, a name that is itself in the popular list is never flagged against another popular name. request and requests are both real, well-known packages.

Where the popular names come from

npm names come from npm-high-impact, which lists the packages npm itself classes as high-impact (a million or more weekly downloads, or 500 or more dependents). PyPI names are the 15,000 most-downloaded projects over 30 days, from PyPI's public download dataset as compiled by top-pypi-packages. Both lists ship with this page, with their dates shown, so the comparison happens entirely in your browser.

The optional registry lookup

For names that match something, you can choose to fetch public metadata from the official registries: when the package was first published, how many maintainers it has, its latest version, and (for npm only) weekly downloads from npm's own statistics API. A lookalike published last week with one maintainer and a handful of downloads tells a very different story from a decade-old package. Only the package names are sent, and only when you ask. PyPI publishes no official download counts, so none are shown for PyPI.

Frequently asked questions

Does this install or download packages?

No. Nothing is installed, imported, executed or downloaded. The optional lookup reads public registry metadata only.

Can it check private or internal package names?

Yes, and the comparison stays in your browser. Do not use the registry lookup for internal names. Asking a public registry about an internal name tells the registry, and anyone watching it, that the name exists: this is how dependency confusion attacks are scoped.

How often are the popular lists updated?

They are bundled with the page and dated on screen. A package that became popular after that date will not be in the list.

References and data

npm-high-impact (MIT)
Top PyPI packages (from PyPI's public BigQuery download data)
Unicode TR39: security mechanisms and confusables

Related tools

What this tool can and cannot tell you. It reports what the named source held when it was queried. Where that source has no record, the answer is unknown rather than safe - an absent entry is not evidence of absence.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.