One Typo Away
Typosquatting publishes malicious packages with names that mimic popular ones, betting that a developer will misspell or misremember the real name. Installing the lookalike runs the attacker's code with the developer's privileges.
Common Tricks
- Swapped or omitted letters, like a missing vowel or a transposed pair.
- Hyphen versus no hyphen, or a singular versus plural name.
- Hijacking the name of a deleted or unmaintained package.
Defenses
- Pin dependencies in a lockfile and review names carefully before adding them.
- Copy names from official documentation, not memory or search snippets.
- Use scanning that flags suspicious or recently published lookalike packages.
Key idea
Typosquatting weaponizes near miss package names, so copy names from official docs, pin them in a lockfile, and scan for lookalikes before installing.