string-twister

string-twister is a TypeScript library for generating variations of strings and URLs by applying different transformations. It is designed for use in security research, homograph attack simulations, and typo-based domain analysis.

Features

• Typo Generation: Create common typographical errors such as swapped characters, missing characters, added characters, repetitions, and replacements.
• Leetspeak Encoding: Convert strings to leetspeak variations.
• Homoglyph Substitutions: Replace ASCII characters with multi-script homoglyphs.
• Math Sans Serif Normalization: Convert text to mathematical sans-serif characters.
• Vowel Removal: Strip English vowels from a string.
• URL Twisting: Generate phishing-like domain variations by adding words, injecting fillers, and encoding hostnames.
• Text Indicator Cleanup: Detect and clean up suspicious invisible characters, non-typable Unicode symbols, and formatting artifacts left behind.

Installation

npm install string-twister

Usage

String Manipulation with StringTwister

import { StringTwister } from "string-twister";

console.log(StringTwister.Typo.charSwap("hello")); // ehlol
console.log(StringTwister.leetspeak("password")); // p455w0rd
console.log(StringTwister.multiScriptHomoglyph("example")); // ехаmрlе
console.log(StringTwister.mathSansSerifNormal("text")); // 𝖙𝖊𝖝𝖙
console.log(StringTwister.removeEnglishVowels("security")); // scrty

URL Manipulation with URLTwister

import { URLTwister } from "string-twister";

const url = "https://example.com";

const twistedUrls = URLTwister.generate(url, [
  StringTwister.Typo.charSwap,
  StringTwister.multiScriptHomoglyph
]);
console.log(twistedUrls);

console.log(URLTwister.addWordsToDomain(url)); // https://secure-example.com
console.log(URLTwister.hostAfterExampleURL(url)); // https://example.com?example.com
console.log(URLTwister.addRandomFillerToDomain(url)); // https://example.com.xajkdz...abc.def

Text Fingerprint Removal with IndicatorsCleaner

import { IndicatorsCleaner } from "string-twister";

const messy = '𝖙𝖊𝖝𝖙\u200B\u2062\u2026'; // Uncommon Unicode characters
console.log(IndicatorsCleaner.deepClean(messy)); // text...

Use IndicatorsCleaner.deepClean() to sanitize AI-generated or copy-pasted text. It:

• Replaces or removes invisible Unicode characters, stylized symbols, and formatting artifacts
• Fixes spacing around punctuation (removes space before periods, commas, etc.)
• Cleans up excessive whitespace (multiple spaces → single space)
• Removes spaces around quotes and brackets
• Eliminates AI "fingerprints" that may look normal but behave strangely in production systems

API

StringTwister

Typo

• charSwap(str: string): Swaps two adjacent characters.
• missingChar(str: string): Removes a random character.
• addedChar(str: string): Inserts a random character.
• repetitions(str: string): Repeats the most frequent character sequence.
• replacedChar(str: string): Replaces a character with a random one.

Other String Transformations

• leetspeak(str: string, n?: number): Converts up to n characters into leetspeak.
• multiScriptHomoglyph(str: string): Replaces ASCII characters with lookalike Unicode homoglyphs.
• mathSansSerifNormal(str: string): Converts characters into mathematical sans-serif.
• removeEnglishVowels(str: string): Removes all vowels from the input.

URLTwister

• generate(url: string, transformers: ((domain: string) => string)[]): Applies transformations to the domain.
• addWordsToDomain(url: string): Inserts security-related words into the domain.
• hostAfterExampleURL(url: string, useIP?: boolean, useFragment?: boolean): Encodes the hostname into a query parameter or fragment.
• addRandomFillerToDomain(url: string): Appends random filler characters to the domain.

IndicatorsCleaner

• deepClean(text: string): string: Normalizes Unicode, replaces suspicious characters with safe equivalents, and strips invisible formatting marks and AI "leftovers".
• findOSIndicators(text: string): string[] : Analyzes a text and returns a list of operating systems that left detectable fingerprints in the content. Detects signs like Windows line endings (\r\n), smart punctuation from iOS, emoji joiners from Android, and Mac-specific symbols

Author

Developed by zviazran