Typosquatting Package Names

Detects imports of known typosquatting package names that mimic popular packages with malicious intent.

zakirkun Updated

File contents

Typosquatting Package Names

Overview

Typosquatting packages mimic the names of popular packages with one-character differences (e.g., lodahs for lodash, requets for requests). They are published to public registries and contain malicious code to steal credentials or install backdoors.

Known historical examples: event-stream, crossenv, babelcli, colourama.

Remediation

  • Carefully verify package names before adding to dependencies
  • Use npm audit and tools like Socket.dev, Snyk, or Dependabot
  • Lock exact versions and verify package integrity hashes

zakirkun/ice-tea/tree/main/skills/supply-chain/typosquatting commit 4f795dc0d4

Frequently asked questions

npx skillmds@latest add zakirkun/typosquatting-package-names