Typosquatting Detection

Detects known typosquatted package names: potential supply chain confusion attacks.


Short name	Typosquatting
Region	Internal
Country or scope	Internal
Sector	Supply Chain
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers Typosquatting

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 7 controls from Safeguard's control catalog for Typosquatting.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for Typosquatting and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`TYPO-PURL` Exact Ecosystem Identity	Detecting look-alike package names requires each component to carry a Package URL fixing its ecosystem, namespace, and exact name (PURL specification; OpenSSF package name-confusion guidance)	Scan
`TYPO-COMPLETE` Name and Version Present	Name-similarity analysis against known-good registries requires every component record to contain both a name and a version (CISA open source software security guidance on dependency hygiene)	Scan
`TYPO-PIN` Pinned Versions	Dependency-confusion attacks exploit floating version ranges that let a higher-versioned malicious package win resolution; versions must be exact, not ranges or 'latest' (OpenSSF / industry dependency-confusion guidance, e.g. namespace substitution attacks)	Scan
`TYPO-HASH` Artifact Hash Comparison	Confirming a suspect package is the legitimate upstream artifact requires integrity hashes to compare against registry-published digests (OpenSSF supply chain integrity guidance)	Scan
`TYPO-SUP` Supplier Attribution	Typosquatted packages typically have suppliers that differ from the legitimate project's maintainer; supplier data per component enables this comparison (OpenSSF package provenance guidance)	Scan
`TYPO-GRAPH` Introduction Path Traceability	When a suspicious package is found, the dependency graph is needed to trace which direct dependency introduced it (CISA SBOM guidance: dependency relationships)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`TS-01`	Package-Name Edit Distance Check
`TS-02`	Known Typosquat Catalog Correlation
`TS-03`	Install-Block Policy for Unreviewed Packages
`TS-04`	Scope and Namespace Squatting Detection
`TS-05`	Homoglyph and Unicode Attack Detection
`TS-06`	New Package Age Verification
`TS-07`	Allowlist Governance and Review Cadence

Policy templates

Written for Typosquatting:

Typosquatting and Malicious Package Detection Policy
Package Allowlist Governance and Install-Block Policy
Dependency Confusion and Internal Registry Security Policy

And 22 from the standard set, adapted to Typosquatting.