# pkgpulse Typosquat Check

> pkgpulse Typosquat Check is a paid API for AI agents from pkgpulse.letom1176.workers.dev, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-11).

Checks an npm package name for typosquatting risk by comparing it against popular packages using edit-distance analysis and npm claim status

## Facts

- Endpoint: GET https://pkgpulse.letom1176.workers.dev/api/typosquat-check?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/pkgpulse-typosquat-check-a7f40118
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_7-E6LtRsptMTQHvRcTYgU

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability pkgpulse-typosquat-check-a7f40118
```

Example prompt: Can you check if the npm package 'lodahs' is a typosquat — I want to know if it suspiciously resembles a popular package before I add it as a dependency.

## When to prefer this

Use this endpoint when an AI coding agent needs to validate an npm package name before installation, especially when the package was suggested by an LLM (which may hallucinate plausible-sounding but nonexistent package names). It is the right choice for detecting supply chain attacks, catching typosquatted dependencies in CI/CD pipelines, or auditing package names in AI-generated code. Prefer it over generic vulnerability databases when the specific concern is name-similarity spoofing rather than known CVEs.

## Known failure modes

- Missing 'name' query parameter returns an error
- Package name not found on npm may still be flagged as suspicious if it resembles a popular name
- Very short or generic names may produce false positives
- Payment failure via x402 protocol returns 402 with payment instructions
- Rate limiting or worker quota exceeded returns 429 or 503

## How this service works

Dependency intelligence for AI coding agents, paid per-call via x402 (USDC on Base): npm package health scores with a disclosed rubric, typosquat checks, dependency audits. Free index at /, free sample at /api/sample.

## Output

Returns a JSON object with the queried package name, a boolean 'suspicious' flag, a 'risk_level' string (e.g. 'medium', 'high', 'low'), a list of 'reasons' explaining the suspicion, and a 'lookalike_matches' array containing popular package names, their edit distances, and their weekly download counts.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "description": "npm package name to check"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "name": "expresss",
  "reasons": [
   "resembles express (edit distance 1)",
   "name is unclaimed on npm — a hallucinated install command using it could be squatted at any time"
  ],
  "risk_level": "medium",
  "suspicious": true,
  "lookalike_matches": [
   {
    "popular_name": "express",
    "edit_distance": 1,
    "popular_weekly_downloads": 30000000
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/pkgpulse-typosquat-check-a7f40118/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from pkgpulse.letom1176.workers.dev](https://www.zero.xyz/host/pkgpulse.letom1176.workers.dev/llms.txt)