Dependency Confusion & Typosquatting Detection

When to use

Prerequisites

• Confused installed (

  go install github.com/nickvdyck/confused@latest

  )
• GuardDog installed (

  pip install guarddog

  )
• Verify:

  confused --help

  and

  guarddog --version

Instructions

Dependency Confusion Check (Confused)

1. Run the scan:
   bash

   # npm
   confused -l npm package.json
   
   # Python
   confused -l pip requirements.txt
   
   # Maven
   confused -l mvn pom.xml

2. Present findings:

| # | Package | Private/Internal | Exists on Public Registry | Risk |
|---|---------|-----------------|--------------------------|------|

Typosquatting / Malicious Package Check (GuardDog)

1. Run the scan:
   bash

   # Scan specific package
   guarddog pypi scan <package-name>
   guarddog npm scan <package-name>
   
   # Verify entire requirements file
   guarddog pypi verify requirements.txt
   guarddog npm verify package.json

2. Present findings:

| # | Package | Indicator | Severity | Description |
|---|---------|-----------|----------|-------------|

1. Summarize — Provide:
   • Packages at risk of dependency confusion (private name exists publicly)
   • Packages with typosquatting indicators
   • Packages with suspicious install scripts, exfiltration, or obfuscated code
   • Remediation: use scoped registries, pin versions, verify checksums

Malicious Indicators Checked

npm install

pip install