CI/CD Package Manager HTTP Request to Registry Lookalike Domain - Phantom Squatting

Duo Tech@duotech

•updated Jul 1, 2026•0•0•3

Detects CI/CD package manager traffic (e.g., pip, npm) attempting to connect to domains that mimic legitimate PyPI or npm registry domains. This behavior is indicative of a dependency confusion or supply chain attack where an adversary uses typosquatted or phantom-squatted domains to intercept or redirect package requests.