Existence checks are dead: attackers now register the packages your AI invents

The rule that catches the common case is not a distance measure at all. According to the author of vetdeps, the string `unused-imports` plus the ecosystem prefix `eslint-plugin-` resolves to a package with 7.8 million weekly downloads ^[7], which is exactly what a model emits when it drops the prefix. Levenshtein cannot see that: the two names sit fifteen edits apart ^[6]. To catch it on edit distance you would have to allow 15, seven and a half times the threshold of 2 that already misfired by calling `znv` a typo of `ajv` ^[15], two unrelated legitimate packages ^[8].

The rest of his measurement log is the useful part, because it is a record of rules that looked correct and were not. Affix rules that stripped a suffix flagged `chalk-cli` as `chalk`, a Sindre Sorhus package published in 2015, and flagged `vite-plugin-vue` as `vue` ^[10]. Those are not typosquats, they are how the ecosystem names things, and the fix was to allow rules that add an affix and never strip one ^[11].

Work the study numbers and you can see why pre-registration pays. Roughly 113,000 of the 576,000 sampled suggestions were names that did not exist ^[16], and if 43 per cent of those recur on identical prompts ^[4], then about one suggestion in twelve is a name an attacker can find by running the same prompt twice ^[17]. Registration costs nothing. The attacker does not need to guess what you will type; he needs to have already typed it.

Against that, the false-positive economics are brutal. `react-fetch-hook` reads like something a model made up and is seven years old with 15,000 weekly downloads ^[5]. Any heuristic keyed on novelty or odd-sounding names kills it, and a tool that flags a real dependency gets removed the same day. The author reports zero false positives on a real 550-package project ^[14]. That is one project, self-measured by the person shipping the tool, and nobody else has run it.

The distribution problem is the one most security tooling loses. Twelve packages already sit in this niche and the most successful has 202 weekly downloads ^[18], all of them scanners a human has to remember to invoke. So vetdeps puts itself in the path instead: a `preinstall` gate on every `npm install`, plus a Claude Code and Cursor hook that blocks the agent before the install runs ^[13]. That second one is the part that matters, since the thing typing the install command in 2026 is frequently not a person reading the name ^[12].

What such a gate can actually answer is a provenance question. `unused-imports` graduated from suspicious-sounding to confirmed malware under OSV advisory MAL-2025-48781 ^[9], `types-node` carries MAL-2024-12159 [c9b], and the tool's own sample finding is `@ctrl/[email protected]` against MAL-2025-47141 ^[19]. Those are lookups against advisory and reputation data, not against the registry's index. Resolution tells you an attacker did his job.