taintrace

Typosquat detector for AI coding agent dependencies.

taintrace scans your lockfiles (Cargo.lock, package-lock.json, requirements.txt, go.sum) for package names that suspiciously resemble known legitimate packages — the exact vector used in the arrayref@0.3.10 attack (August 2026), where proc-macro1 imitated proc-macro2 to execute arbitrary code during cargo build.

The Problem

AI coding agents install dependencies automatically. Typosquats pass undetected by scanners like cargo audit or npm audit because they have no known CVE — they're brand new packages with malicious build.rs or proc-macros.

Traditional scanners check known-bad. taintrace checks suspicious-similar.

Install

pip install taintrace

Usage

Scan a lockfile

taintrace check Cargo.lock

╭──────────────────────────────────────────────╮
│ taintrace v0.1.0 — scanning Cargo.lock       │
│ Total deps: 42 | Suspects: 1                 │
╰──────────────────────────────────────────────╯

🚨 Typosquat Suspects
┏━━━━━━━━━━━━━┳━━━━━━━━━━┳━━━━━━━┳━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Package     ┃ Risk     ┃ Score ┃ Similar To     ┃ Reason                  ┃
┣━━━━━━━━━━━━━╋━━━━━━━━━━╋━━━━━━━╋━━━━━━━━━━━━━━━━╋━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ proc-macro1 ┃ CRITICAL ┃ 0.980 ┃ proc-macro2    ┃ Near-identical to...    ┃
┗━━━━━━━━━━━━━┻━━━━━━━━━━┻━━━━━━━┻━━━━━━━━━━━━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━━┛

❌ 1 suspect(s) found — review required

JSON output (CI/CD)

taintrace check Cargo.lock --format json

SARIF output (GitHub Code Scanning)

taintrace check Cargo.lock --format sarif > results.sarif

Score a single package

taintrace score proc-macro1

Exit codes

• 0 — no suspects found
• 1 — one or more suspects detected (use in CI/CD gates)

Algorithms

• Levenshtein distance — edit distance between names
• Soundex phonetic — catches homophones ("night" vs "nite")
• Substring matching — detects containment ("lodash" vs "lodash1")
• Combined scoring — weighted combination of all signals

Multi-ecosystem

Multi-ecosystem

CI/CD integration

GitHub Action

- uses: yunaremaia/taintrace@main
  with:
    lockfile: Cargo.lock
    format: sarif
    sarif-output: taintrace.sarif
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: taintrace.sarif

Auto-detect lockfiles in your repo root:

- uses: yunaremaia/taintrace@main
  with:
    format: cli

Pre-commit hook

repos:
  - repo: https://github.com/yunaremaia/taintrace
    rev: v0.2.0
    hooks:
      - id: taintrace

Why taintrace?

• AI-agent-aware — built for the vector AI agents expose (automatic dep installation)
• Zero config — just point at your lockfile
• Offline-first — no API calls, no data leaves your machine
• SARIF-native — integrates with GitHub Code Scanning
• Open source — MIT licensed, no paywall

How it differs

License

MIT — see LICENSE