# Dependency Trust – Typosquat Lookalike Checker

> Dependency Trust – Typosquat Lookalike Checker is a paid API for AI agents from dep-trust.agent-utils.workers.dev, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-14).

Detects typosquatting lookalikes for a given package name on npm, PyPI, or crates.io by returning edit-distance similar popular packages and a suspicion flag.

## Facts

- Endpoint: GET https://dep-trust.agent-utils.workers.dev/v1/typosquat
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dependency-trust-typosquat-lookalike-checker-916bcc92
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_cuxKvJdmTRYjv0tNGvWXR

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dependency-trust-typosquat-lookalike-checker-916bcc92
```

Example prompt: Before I install it, can you check if the npm package 'lodahs' looks like a typosquat of any popular packages?

## When to prefer this

Use this endpoint when you specifically need to detect whether a package name is a typosquatting lookalike of a popular package — ideal for pre-install checks, CI/CD pipeline security gates, or security audits of unfamiliar dependencies. Prefer this over general vulnerability scanners when the primary concern is supply-chain name-spoofing attacks rather than CVEs or license issues. Best for npm, PyPI, and cargo ecosystems.

## Known failure modes

- Unknown ecosystem returns validation error — only npm, pypi, cargo are currently supported
- Package name not found returns empty lookalikes array with suspicious:false — not an error, just no matches
- Missing required query parameters (name or ecosystem) returns a 400-level error
- Rate limiting or payment failure via x402 may block requests if USDC payment is not properly attached
- Very new or extremely obscure packages may lack popularity rank data, returning popularRank:null

## How this service works

Should your agent install this package? Vulnerabilities, license, age, popularity, provenance, typosquat lookalikes and a trust score for npm, PyPI, crates.io, Go and Maven, in one call. Pay per call over x402, no API key.

## Output

Returns a JSON object with the queried package name, ecosystem, whether it is popular, its popularity rank (or null), an array of lookalike packages (each with kind, name, rank, and edit distance), and a boolean 'suspicious' flag indicating whether the name appears to be a typosquat.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ecosystem",
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "description": "Package name (npm scoped names allowed; Maven as groupId:artifactId; Go as module path)"
      },
      "ecosystem": {
       "enum": [
        "npm",
        "pypi",
        "cargo"
       ],
       "type": "string"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "name": {
       "type": "string"
      },
      "ecosystem": {
       "enum": [
        "npm",
        "pypi",
        "cargo",
        "go",
        "maven"
       ],
       "type": "string",
       "description": "Package ecosystem"
      },
      "isPopular": {
       "type": "boolean"
      },
      "lookalikes": {
       "type": "array",
       "items": {
        "type": "object"
       }
      },
      "suspicious": {
       "type": "boolean"
      },
      "popularRank": {
       "type": [
        "integer",
        "null"
       ]
      }
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "name": "lodahs",
  "ecosystem": "npm",
  "isPopular": false,
  "lookalikes": [
   {
    "kind": "edit-distance",
    "name": "lodash",
    "rank": 34,
    "distance": 1
   }
  ],
  "suspicious": true,
  "popularRank": null
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dependency-trust-typosquat-lookalike-checker-916bcc92/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dep-trust.agent-utils.workers.dev](https://www.zero.xyz/host/dep-trust.agent-utils.workers.dev/llms.txt)