Scan New Dependencies for Typosquatting Attacks
A single typosquatted package name in a pull request can inject malware into your build. Scan new dependencies in PRs against known-good names and flag suspicious near-matches.
- 1
Watch Dependency Changes
Add a
GitHub Triggeron PRs modifying package manifests. - 2
Check the New Packages
Add a step comparing added packages against popular-package names and your known-good list.
- 3
Judge Suspicious Names
Add an
OpenAInode flagging near-misses of popular packages and other red flags. - 4
Flag for Review
Add a
Slacknode surfacing suspicious dependencies to the reviewer. - 5
Activate and Test
Activate the workflow with a typosquat test package. Confirm it's flagged.
Frequently asked questions
Why is this a real threat?
Typosquatting is a documented supply-chain attack vector — a name one letter off can be pure malware.
False positives?
Flag for human review rather than blocking — a reviewer confirms legitimate new dependencies quickly.
Verify Every Shoot's Footage Is Backed Up Before You Leave Set
A videographer's nightmare is discovering a corrupt card after the client's one-time event. Log each card's offload and verify redundant backups before leaving set.
Free recipeReplay Failed Webhooks From a Dead Letter Queue Automatically
Failed inbound webhooks silently drop events that never get processed. Capture failures into a dead letter queue and replay them automatically once the issue clears.
Free recipeBlock Disposable Email Signups From Poisoning Your Trial Metrics
Disposable-email trial signups inflate your funnel and abuse free tiers. Detect throwaway domains at signup and route them for verification before they count as trials.