Catching Supply Chain Typosquatting: VS Code Copilot and Suspicious Packages

Correction note (2026-10-13). The per-call timings and latency figures that appeared in this article had no benchmark behind them and were removed. Sample output in this article is illustrative, not a recorded run. The only published measurement is p50 0.39 ms and p99 1.91 ms (sigmashake-bench daemon-socket run, 2026-06-10, ssg 0.29.156, n=500). Sub-2 ms evaluation is a design target.

Correction note (2026-10-13). An earlier version of the lockfile rule in this article used NOT_CONTAINS "npm install" with no field. The rule DSL spells it content NOT CONTAINS "npm install" (the field, then NOT, then the operator), so the rule did not load.

Describe the task

VS Code Copilot is adding a utility library. It searches for lodash but installs a package with a similar name — a common typosquatting vector:

npm install l0dash

SSG flags the unusual name pattern and routes it for review before the install executes.

# illustrative sample output
[ASK] bash › npm install l0dash — rule: ask-suspicious-npm-name
Waiting for human approval...

Give SSG context

SSG evaluates VS Code Copilot's shell commands via the SSG MCP Server integration.

Required context

rule ask-suspicious-npm-name {
  enabled true
  priority 90
  severity warning
  ASK execution
  IF command STARTS_WITH "npm install"
  AND command MATCHES ".*(l0dash|1odash|Iodash|express-js|reacts|nextjs-app|mongoo).*"
  PROMPT "Package name resembles a known library but is not exact. Verify before installing."
  MESSAGE "Package name resembles a known library but is not exact. Verify before installing."
}

Optional context

Catch lookalike character substitutions broadly:

rule ask-npm-lookalike {
  enabled true
  priority 85
  severity warning
  ASK execution
  IF command STARTS_WITH "npm install"
  AND command MATCHES ".*[0Ol1I]{2,}.*"
  PROMPT "Package name contains suspicious character substitutions. Verify package identity."
  MESSAGE "Package name contains suspicious character substitutions. Verify package identity."
}

What SSG does

SSG pauses the npm install and surfaces it in the approval queue. You can verify the package on npmjs.com before deciding whether to allow or block the install.

Ask the agent to verify the package name

npm install was escalated: package name looks like a typosquatting attempt.
Before approving:
  1. Search the exact name on https://npmjs.com
  2. Check the download count and publish date
  3. Review the package source on GitHub
  4. Confirm the maintainer matches the expected author
If the package is legitimate, approve in the SSG dashboard.

Pair with a lockfile integrity rule

After installing a legitimate package, protect the lockfile from future tampering:

rule protect-lockfile {
  enabled true
  priority 100
  severity error
  DENY write
  IF path ENDS_WITH "package-lock.json"
  AND content NOT CONTAINS "npm install"
  MESSAGE "Direct lockfile modification is blocked. Use npm install to update dependencies."
}

Monitor download anomalies

Newly published packages with high install commands but few GitHub stars are a red flag. Use npm info <package> to check age and download history before installing.