# Paket Typosquat Radar

> Paket Typosquat Radar is a paid API for AI agents from paket.halowerk.com, paid per call via x402, $0.006/call, status unknown (last checked 2026-09-15).

Generates plausible typosquatting variants of a package name and checks each one against seven package registries to detect malicious or squatted lookalikes.

## Facts

- Endpoint: POST https://paket.halowerk.com/v1/typosquat-radar
- Price: $0.006/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/paket-typosquat-radar-19f1718a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_IZN8jwt1haf8UrYTJXOt4

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability paket-typosquat-radar-19f1718a -d '<json body>'
```

Example prompt: Check whether anyone has typosquatted my npm package 'express-validator' — generate all the common misspellings and look each one up in the registry to see if any of them are already taken.

## When to prefer this

Use this endpoint when you need to proactively detect typosquatting threats against a specific package name across multiple ecosystems. Unlike registry search APIs (which rank by popularity and miss newly registered squats), this endpoint generates the misspellings algorithmically and performs direct lookups, making it effective for catching fresh squats with zero downloads. Prefer this over manual searches or popularity-ranked search APIs when supply chain security and early detection are priorities.

## Known failure modes

- Unknown or unsupported ecosystem returns an error or empty results
- Package name too short to generate meaningful variants
- Registry rate limiting causing incomplete lookup coverage
- Network timeouts on individual registry checks resulting in partial results
- Invalid package name format rejected with validation error

## How this service works

Generates the typical misspellings of a package name and looks up every one of them in the registry. Generation rather than search is deliberate: most of the seven ecosystems have no search API, and the ones that do rank by popularity instead of similarity, so a fresh squat with no downloads never appears.

## Output

Returns a list of generated typo variants for the given package name along with registry lookup results for each variant across supported ecosystems, indicating which variants are already registered, by whom, and any associated risk signals for potential squatting.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "name": {
   "type": "string",
   "maxLength": 120,
   "minLength": 3,
   "description": "The package name to protect."
  },
  "system": {
   "enum": [
    "npm",
    "pypi",
    "maven",
    "go",
    "cargo",
    "nuget",
    "rubygems"
   ],
   "type": "string"
  },
  "recent_days": {
   "type": "integer",
   "default": 365,
   "maximum": 3650,
   "minimum": 1,
   "description": "A variant first published within this many days counts as recent, which is the strongest signal."
  },
  "max_variants": {
   "type": "integer",
   "default": 45,
   "maximum": 80,
   "minimum": 5,
   "description": "How many generated variants to look up."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/paket-typosquat-radar-19f1718a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from paket.halowerk.com](https://www.zero.xyz/host/paket.halowerk.com/llms.txt)