Typosquatting Risk in Dependencies
Server depends on 'expresss' (triple s) with Levenshtein distance 1 from 'express'
- 1Open the manifest and confirm the dependency `distro@1.9.0` is present. The scanner's similarity pipeline matched this name against the curated target `discord` via the levenshtein-near classifier. If this dependency is an intentional internal fork or re-export, add it to `legitimate-forks.ts` so the finding will no longer fire.
npm:distro@1.9.0Expect: Dependency npm:distro@1.9.0 is declared; it is NOT in the legitimate-fork allowlist at scan time. - 2Recompute the Damerau-Levenshtein distance and Jaro-Winkler similarity between `distro` and `discord` using the same primitives as the scanner. Concretely, the rule expects Damerau-Levenshtein ≤ 3 and Jaro-Winkler ≥ 0.80 (except for advisory-registry matches which skip the floor). Observed values: distance 3, Jaro-Winkler 0.848.
npm:distro@1.9.0Expect: Damerau-Levenshtein distance between "distro" and "discord" is 3. Jaro-Winkler is 0.848. The numbers agree with what the rule recorded. - 3Open the package manifest at this RFC 6901 pointer and read the line. Confirm the package name recorded in the manifest is literally `distro` (not a spelling the build tool fuzzed to) and that no post-resolution rewrite turns this entry into the legitimate `discord`.
package.json/dependencies/distroExpect: The manifest entry at package.json/dependencies/distro resolves to distro@1.9.0 — the exact name the scanner flagged. - 4Open the npm page for `distro` and compare against the legitimate `discord`. Check: publisher identity, publish date, weekly download count, repository link, postinstall script presence. A typosquat typically presents as: recently published, low download count, no repository link, optionally carrying a postinstall hook that executes code at install time.
npm:distro@1.9.0Expect: Either the candidate is a legitimate publisher-authored alternative (in which case add to `legitimate-forks.ts`) or its metadata confirms the typosquat hypothesis (recent, unknown publisher, low downloads, suspicious scripts).
npm:distro@1.9.0Dependency npm:distro@1.9.0 is within Damerau-Levenshtein distance 3 of discord (threshold 3).
Dependency names are external content resolved from public package registries. A near-miss to a popular canonical name is a supply-chain anomaly under ISO 27001 A.5.21 — the package manager installs whichever spelling is declared, with no built-in guard against lexically similar substitutions.
package.json/dependencies/distroThe manifest entry at /dependencies/distro directs the package manager to resolve and install distro@1.9.0. Resolution is purely string-matched against the registry — a typosquatted name installs whatever code the squatter published.
npm:distro@1.9.0Malicious package `distro` executes attacker code in the build environment or at import time. Attack classifier: levenshtein-near. Target shadowed: `discord`.
package.json/dependencies/distroLockfiles pin versions but do not pin the spelling of the dependency name. The static analyser cannot confirm whether a typosquat-aware package firewall (Socket.dev, Snyk Advisor) is in the CI chain; the auditor must verify.
server-host
A developer installs `distro` by typo, copy-paste, or autocomplete. The package's postinstall hook runs during installation with the developer's or CI runner's credentials, or the payload executes on first import when the MCP server starts. An MCP server compromised this way delegates full tool authority to attacker code on every downstream agent interaction.
trivial- 1Open the manifest and confirm the dependency `pyaml@25.5.0` is present. The scanner's similarity pipeline matched this name against the curated target `pyyaml` via the levenshtein-near classifier. If this dependency is an intentional internal fork or re-export, add it to `legitimate-forks.ts` so the finding will no longer fire.
pypi:pyaml@25.5.0Expect: Dependency pypi:pyaml@25.5.0 is declared; it is NOT in the legitimate-fork allowlist at scan time. - 2Recompute the Damerau-Levenshtein distance and Jaro-Winkler similarity between `pyaml` and `pyyaml` using the same primitives as the scanner. Concretely, the rule expects Damerau-Levenshtein ≤ 2 and Jaro-Winkler ≥ 0.80 (except for advisory-registry matches which skip the floor). Observed values: distance 1, Jaro-Winkler 0.956.
pypi:pyaml@25.5.0Expect: Damerau-Levenshtein distance between "pyaml" and "pyyaml" is 1. Jaro-Winkler is 0.956. The numbers agree with what the rule recorded. - 3Open the package manifest at this RFC 6901 pointer and read the line. Confirm the package name recorded in the manifest is literally `pyaml` (not a spelling the build tool fuzzed to) and that no post-resolution rewrite turns this entry into the legitimate `pyyaml`.
pyproject.toml/project/dependencies/pyamlExpect: The manifest entry at pyproject.toml/project/dependencies/pyaml resolves to pyaml@25.5.0 — the exact name the scanner flagged. - 4Open the PyPI page for `pyaml` and compare against the legitimate `pyyaml`. Check: publisher identity, publish date, weekly download count, repository link, postinstall script presence. A typosquat typically presents as: recently published, low download count, no repository link, optionally carrying a postinstall hook that executes code at install time.
pypi:pyaml@25.5.0Expect: Either the candidate is a legitimate publisher-authored alternative (in which case add to `legitimate-forks.ts`) or its metadata confirms the typosquat hypothesis (recent, unknown publisher, low downloads, suspicious scripts).
pypi:pyaml@25.5.0Dependency pypi:pyaml@25.5.0 is within Damerau-Levenshtein distance 1 of pyyaml (threshold 2).
Dependency names are external content resolved from public package registries. A near-miss to a popular canonical name is a supply-chain anomaly under ISO 27001 A.5.21 — the package manager installs whichever spelling is declared, with no built-in guard against lexically similar substitutions.
pyproject.toml/project/dependencies/pyamlThe manifest entry at /project/dependencies/pyaml directs the package manager to resolve and install pyaml@25.5.0. Resolution is purely string-matched against the registry — a typosquatted name installs whatever code the squatter published.
pypi:pyaml@25.5.0Malicious package `pyaml` executes attacker code in the build environment or at import time. Attack classifier: levenshtein-near. Target shadowed: `pyyaml`.
pyproject.toml/project/dependencies/pyamlLockfiles pin versions but do not pin the spelling of the dependency name. The static analyser cannot confirm whether a typosquat-aware package firewall (Socket.dev, Snyk Advisor) is in the CI chain; the auditor must verify.
server-host
A developer installs `pyaml` by typo, copy-paste, or autocomplete. The package's postinstall hook runs during installation with the developer's or CI runner's credentials, or the payload executes on first import when the MCP server starts. An MCP server compromised this way delegates full tool authority to attacker code on every downstream agent interaction.
trivial