Suspicious NPM Package Installation (Typosquatting/Supply Chain)

Ankit Mehta@Secvyn

•updated Jun 17, 2026•1•0•6

Detects suspicious NPM package installations that may indicate typosquatting or supply chain compromise attempts. The rule looks for `npm install` or `npm add` commands with package names containing special characters (@, ^, ~) and common prefixes used in typosquatting (typosquatting-, common-, util-), while excluding 'json' to reduce false positives. A high count of such installations within an hour from a single user and computer is flagged.