Typosquatting Package Names
Overview
Typosquatting packages mimic the names of popular packages with one-character differences (e.g., lodahs for lodash, requets for requests). They are published to public registries and contain malicious code to steal credentials or install backdoors.
Known historical examples: event-stream, crossenv, babelcli, colourama.
Remediation
- Carefully verify package names before adding to dependencies
- Use
npm auditand tools like Socket.dev, Snyk, or Dependabot - Lock exact versions and verify package integrity hashes