Detect Typosquatted and Malicious npm Packages

Typosquatting attacks work because developers type package names quickly. Installing `lodahs` instead of `lodash`, or `crossenv` instead of `cross-env`, can execute credential-stealing or backdoor code silently. These packages are designed to evade detection by looking legitimate — they often include the real code alongside the malicious payload.

The package_risk skill includes typosquat detection signals: download count anomalies relative to similar package names, newly created packages with names close to top-downloaded libraries, and behavioural indicators from static analysis. A package with 80 downloads that's one character away from a package with 80 million is a signal worth investigating.

Developers who want to verify a package name before installing, security tools that scan package.json for suspicious names, and teams onboarding contractors who might have installed packages on their machines all use this to catch typosquat attempts before they become incidents.