Presend for teams

Typosquat and publisher-change checks for npm and PyPI dependencies, in your pull requests and before your AI agent installs a package, with a false-positive rate we measure and publish, so the checks stay switched on.

Nothing is for sale yet: this page tests whether teams want more. The checks themselves are free today. If your platform's agents or users install packages, you can ask for a free one-month pilot: send us package names (no code) and we report what would have been flagged, why, and how many of those alerts were false. Write to [email protected].

Use it today, free

In a GitHub workflow, after actions/checkout:

- uses: presendapp/presend-check-action@v1
  with:
    ecosystem: npm   # or pypi

It checks typosquats, names that do not exist, packages less than 30 days old, publisher changes (npm only) and known vulnerabilities of the installed version. It sends package names and versions, never your code, and fails the job when it finds an issue (fail-on-issue: false to only report). Details.

For AI agents: the MCP server at https://presend.pages.dev/mcp-deps (the five dependency checks only, Streamable HTTP, no key; the full server with 40 tools is at /mcp). In Claude Code and Cursor, a pre-install hook runs the check on every npm install or pip install the agent attempts, whatever the agent decides: names that do not exist are blocked, new or suspicious ones are flagged.

Or paste a package.json or requirements.txt into the online check; only package names are sent.

What the checks do today

These checks already exist and are free through the API and the MCP server (per-minute rate limits apply). Last measured on 8 October 2026: full results, method and blind spots; the code and test sets are public.

Typosquats (npm and PyPI). On the top 15,000 PyPI packages, 11 are flagged, each one reviewed and left flagged deliberately. On about 17,000 high-impact npm packages, 1 is flagged. All 24 names in our typosquat test set are detected (look-alikes of popular packages, several from real incidents such as crossenv and python3-dateutil).
New publisher after a dormant period (npm only). The pattern behind the event-stream attack. Evaluated on the 200 most depended-upon npm packages at 9 dates over two years: 1 package flagged. It cannot see a hijacked account that keeps the same publisher name.
Known vulnerabilities of the exact version you use, from OSV.dev, rather than of the package as a whole.
Names that do not exist (npm and PyPI), for instance invented by an AI model: the supply-chain check reports them as such instead of as clean. A name that someone has already registered passes this check; if it was first published less than 30 days ago, it is reported as a new package instead. One registered earlier is not caught.

The same measurement, applied to NVIDIA's open-source SkillSpector, led to a fix we contributed (PR #647, merged).

What they do not do

There is no behavioural analysis of package code and no malware detection. Use these checks alongside a malware scanner such as Socket or Aikido, not instead of one.

What teams would get (planned, not built)

A comment on every pull request that adds or changes a dependency (GitHub app).
Higher limits for AI coding agents that check every package before installing it (MCP).
API keys with higher limits than the free tier.
The measurements re-run and published with every release of the checks.
A weekly check of the install commands in your public READMEs, docs and MCP configurations, with an alert when one points to a package name that is not registered on npm or PyPI (anyone could publish under it). We can run a first check by hand on request.

Working with us