How Stateward protects you against typosquatting & slopsquatted packages
The threat
Attackers publish packages one keystroke away from a popular name, and AI assistants confidently import dependencies that don’t exist, "slopsquatting", which attackers then register and weaponise.
How Stateward catches it
Stateward’s supply-chain engine flags names within typo-distance of a popular package, packages that don’t exist on the registry (hallucinated/slopsquatted), and non-registry sources (git+, file:, http:), then analyzes each added package’s published behavior: install/postinstall hooks that run network/exec/obfuscated code, or install code with no source repository, the dependency-confusion malware shape that CVE databases miss.
Recent advisories of this class
- highCVE-2026-96627Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
- mediumCVE-2026-96628Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
- criticalCVE-2026-105192LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
- highCVE-2026-100349kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content
Check your own repo for this
Connect a repo and Stateward reviews your next pull request, read-only, free for individuals and open source.
Built to be trusted with your code
Read-only & ephemeral
Stateward can comment, but never pushes, merges or stores your keys.
EU hosting & data residency
Code and security data stay EU-hosted with EU data residency, built for NIS2, DORA and the CRA.
Whole-codebase aware
Reasons over your call graph and trust boundaries, not just the diff.
Stateward is live and ready to guard your code. Built by Yggdrasil Digital.