Typosquatting
Typosquatting is a supply chain attack where an attacker publishes a malicious package under a name that closely misspells or mimics a popular legitimate package, so developers who make a typo or copy a wrong name install the malicious version.
Typosquatting in the software supply chain means registering package names that are common misspellings, transpositions, or lookalikes of widely used libraries — for example swapping two letters, adding a hyphen, or using a similar-looking character. When a developer mistypes the name in an install command or a manifest, the package manager happily fetches the impostor.
The malicious package usually mimics the real one so the mistake goes unnoticed, while its install scripts or runtime code perform harmful actions such as stealing credentials, exfiltrating environment variables, or installing a backdoor. Because installation often runs with the developer's or CI system's privileges, a single mistyped dependency can compromise a build environment.
Developers reduce this risk by copying exact package names from trusted sources rather than typing them, reviewing dependencies before adding them, using lockfiles to freeze exact resolved packages, and running dependency scanners that flag suspicious or newly published lookalike names. Registries also increasingly detect and remove typosquatted packages, but vigilance at install time remains the first line of defense.