Package Manager Fetching from Non-Canonical Registry (Phantom Squatting)
Detects usage of pip or npm package managers where non-canonical registry or index URLs are explicitly specified. This behavior can be indicative of software supply chain poisoning, specifically attacks involving typo-squatting or AI-hallucinated malicious package repositories.
Sigma
