Catching Supply Chain Typosquatting: Windsurf and Suspicious Packages

Correction note (2026-10-13). Sample output in this article is illustrative, not a recorded run.

Correction note (2026-10-13). An earlier version of the rules in this article used the operator MATCHES_REGEX, which the rule DSL does not have, and the allow rule had no MESSAGE. The rules now use REGEX, the allow rule has a MESSAGE, and the two name patterns sit in parentheses so that they stay inside the AND.

Describe the task

You ask Windsurf to add a color utility library. The agent searches the registry and installs:

npm install cIors

cIors (capital I instead of lowercase l) is a typosquatted package impersonating the popular colors library. It may execute a postinstall script that exfiltrates environment variables, installs a backdoor, or simply breaks your build. SSG's ask-suspicious-package rule flags the install before npm runs.

# illustrative sample output
[ASK] bash › npm install cIors — rule: ask-suspicious-package
Unusual package name pattern. Confirm before installing?

Give SSG context

SSG evaluates Windsurf's shell commands via the SSG MCP Server integration inside Windsurf (Cascade).

Required context

rule ask-suspicious-package {
  enabled true
  priority 75
  severity warning
  ASK execution
  IF command STARTS_WITH "npm install "
  AND (command REGEX "npm install\s+[a-zA-Z]{2,}\.js" OR command REGEX "npm install\s+[a-zA-Z0-9-]+[0-9]{3,}")
  MESSAGE "Unusual package name pattern. Verify this is the correct package before installing."
  PROMPT "Allow this package install?"
}

Optional context

Create an allowlist of known-safe packages that skip the check:

rule allow-known-packages {
  enabled true
  priority 76
  severity info
  ALLOW execution
  IF command CONTAINS "npm install"
  AND command REGEX "@types/|typescript|react|express|prisma|hono"
  MESSAGE "Known-safe package."
}

What SSG does

On an ASK decision, Windsurf's install call is paused and routed to your ssg dashboard. You see the exact package name and can verify it on npmjs.com before approving.

Ask the agent to verify the package name

The package name was flagged as unusual. Before approving:
1. Check npmjs.com for the exact package: https://www.npmjs.com/package/cIors
2. Verify the author and weekly downloads
3. Compare against the intended package name: "colors"

If this is a typo, install the correct package: npm install colors

Check the package for postinstall scripts

Even for approved packages, ask Windsurf to check for postinstall scripts:

npm info <package-name> scripts

Any postinstall script that runs arbitrary code is a red flag.

Lock your dependencies after each install

Pair with a rule that requires package-lock.json to be committed after every install:

rule require-lockfile-commit {
  enabled true
  priority 60
  severity info
  ASK execution
  IF command STARTS_WITH "npm install"
  MESSAGE "After installing, commit the updated package-lock.json to lock the dependency graph."
  PROMPT "Allow this npm install?"
}

How your pattern detects typosquats

The regex catches common patterns: packages ending in .js (like express.js impersonating express), and packages with long numeric suffixes (like react1234). Extend with patterns specific to your tech stack.

Check the rule against your devDependencies routine

Your normal workflow of npm install --save-dev typescript won't trigger the regex — typescript is a clean alpha string. The rule is designed to catch anomalous patterns without blocking normal installs.