Typosquatting
What Is Typosquatting?
Typosquatting is publishing a malicious package with a name almost identical to a popular one, to catch mistyped or misremembered installs. A single swapped letter can be enough to run an attacker's code.
Common Typosquatting Techniques
Attackers use a handful of patterns:
- Swapped, missing or doubled characters
- Hyphen and underscore variations
- Look-alike names that add words such as "js" or "official"
- Names in a different namespace or scope
Each relies on speed and familiarity beating careful reading.
Why Typosquatting Matters
Public registries accept new packages quickly, and installs can run code immediately. The malicious package often copies the real one and adds a payload that steals credentials or opens a backdoor. AI coding assistants that suggest package names can also introduce near-miss names.
How to Reduce Typosquatting Risk
- Install only from an approved, controlled registry
- Review new dependencies in pull requests
- Scan packages for malware before use
- Hold very new or low-reputation packages
Final Thought
Typosquatting exploits human habit, so the defense should not depend on human attention alone.
Frequently asked questions
Is typosquatting illegal?
Publishing malware is illegal in most jurisdictions, and registries remove such packages when they find them.
How is typosquatting different from dependency confusion?
Typosquatting depends on a mistyped name. Dependency confusion depends on a correct internal name resolving to a public package.
Can scanners detect typosquatted packages?
Often, through name similarity checks and malware analysis, but detection is not guaranteed for new packages.
Does typosquatting only affect npm?
No. It has been seen on PyPI, RubyGems, NuGet and other registries.