sup-03-marketplace-typosquat: Plugin/extension marketplace typosquat demo
Category: AI supply chain (feintkit-supplychain). Loopback port: none (standard input and output only).
What it simulates
An attacker lists a plugin whose name is one character off a popular plugin, with inflated popularity, so that a person or an agent installs the lookalike.
Plugin, extension, and tool marketplaces let anyone publish under a name that is not yet taken, so an attacker can list a plugin whose name differs from a popular one by a single character and hope that a person, or an agent that picks a plugin by name, installs the wrong one; the practice is typosquatting. The listing can also show popularity numbers that make the lookalike seem established. This scenario writes a fictional marketplace listing with an invented popular plugin and a lookalike one character shorter, plus the manifest of the lookalike, all under reserved feintkit-canary- names with invented counts. The files contain no code, no command, no hook, no dependency, and no URL, and the scenario never publishes, installs, or resolves anything. A security product should flag any attempt to resolve or install the reserved lookalike name, and may flag a listing whose name is one edit from another listed name.
Mapping
- MITRE ATLAS: AML.T0074, AML.T0111, AML.T0115.002
- OWASP LLM Top 10 2025: LLM03:2025
- OWASP Agentic Top 10 2026: ASI04
Why these techniques apply
- AML.T0074: Typosquatted name mimics a popular plugin.
- AML.T0111: Fake trust signals inflate perceived legitimacy.
- AML.T0115.002: Poisoned agent tool published to a registry.
What a product should detect
| Signal | What to flag | Where | Match rule |
|---|---|---|---|
| S1 | A plugin-manager or package-manager command, marketplace or registry request, or assistant output that resolves, installs, or recommends a reserved canary name | process command lines, marketplace or proxy request paths, agent reply or transcript | feintkit-canary-[a-z0-9-]+ |
| S2 | The lookalike listing and plugin manifest in a project, repository, or output directory | canary/marketplace.canary.json and canary/plugin.canary.json in the output directory, or wherever a tester copied them | "lookalikeOf": "feintkit-canary-tidycode"|"name": "feintkit-canary-tidycde" |
| S3 | Feintkit marker string in the canary files, the marker file, and the events | output directory (canary/marketplace.canary.json, canary/plugin.canary.json, proof.txt, events.jsonl) | FEINTKIT::sup-03-marketplace-typosquat::[A-Za-z0-9]{4,16}::DEFENSIVE-TEST-ONLY |
What a defender can do
- Restrict: Install plugins only from verified publishers, and compare the exact name and publisher before installing.
- Add a rule: Flag an install of a plugin whose name is one character away from a popular plugin.
- Change a setting: Use an allow list of plugins and publishers, and do not rely on download counts or ratings to judge trust.
Run it
feintkit run sup-03-marketplace-typosquat --root <repository> --deterministic, then feintkit verify sup-03-marketplace-typosquat --root <repository>.
Every artifact contains FEINTKIT::sup-03-marketplace-typosquat::<run id>::DEFENSIVE-TEST-ONLY. Read RESPONSIBLE-USE.md before running.