What is typosquatting?

How package typosquatting works

1. Pick a target. The attacker chooses a popular package, where even a small rate of typos adds up.
2. Register a near name. It differs by a letter, a missing hyphen, a swapped character or a plausible suffix.
3. Hide the payload. The package often wraps the real one, so everything still works and nothing looks wrong.
4. Run on install. Package managers can run scripts during installation, so the code runs before anyone calls it, with access to environment variables and tokens.
5. Steal and spread. Stolen credentials let the attacker publish further packages or reach further systems.

Common typosquatting techniques

Technique	Real package	Lookalike
Missing separator	cross-env	crossenv
Added suffix	jquery	jquery.js
Swapped letters	ffmpeg	ffmepg
Dropped letter	mongoose	mongose
Added prefix	sqlite	node-sqlite

All of the lookalikes above come from one real campaign, described next.

A real example: crossenv

In 2017, an npm user named hacktask published crossenv, imitating the popular cross-env. It kept the real package's behavior and also sent the environment variables of whoever installed it to the attacker's server. In a build, environment variables are where tokens live. Snyk's analysis found it was one of more than 30 malicious packages from the same account, and that it went unnoticed for about two weeks until an engineer spotted it.

Why AI coding assistants make it worse

An AI assistant can suggest a package that does not exist. If an attacker registers that name, the next person to accept the suggestion installs the malware. This is sometimes called slopsquatting. Automated agents that install dependencies without a human reading the name raise the stakes further.

Typosquatting vs dependency confusion

Both exploit how package names resolve, but the mistake is different.

	Typosquatting	Dependency confusion
Whose mistake	A person mistypes a name	A build system picks the wrong registry
The name	Close to a public package	Identical to a private, internal package
How it wins	Someone installs it by accident	A public version with a higher number takes priority
Main defense	Lockfiles and review of new dependencies	Scoped packages and a registry configuration that keeps internal names private

Dependency confusion was made famous in 2021, when researcher Alex Birsan used it to get code running inside more than 35 organizations, including Apple, Microsoft and PayPal, under bug bounty programs or with permission.

How to prevent typosquatting

• Install from a lockfile in CI. Use npm ci and its equivalents. A typo can then only arrive through a reviewed change. See what a lockfile does and does not do.
• Review new dependencies in pull requests. Look at the name itself, and read a diff of the lockfile instead of skipping it.
• Check before installing. Compare the name with the project's own documentation, and be wary of a package with few downloads, a recent first publish or no repository link.
• Limit install scripts. Disable them where your build allows it.
• Wait before adopting new packages. Malicious packages are often found and removed soon after they appear.
• Limit what a build can reach. A build that can only talk to known hosts cannot send your secrets to an attacker, even if a bad package runs. See GitHub Actions egress policy.
• Check every AI suggestion. Confirm a package exists and is the one you meant before you install it.

Keep in mind that a typosquat has no CVE on the day it appears, so an SCA scan based on advisories will not flag it. For more, see software supply chain security best practices.

Domain typosquatting

The original form of the attack, also called URL hijacking, registers a domain such as a misspelled bank or login page. Visitors who mistype the address land on a copy of the site built to steal credentials or serve malware. Defenses are different: register common misspellings of your own domains, monitor for lookalike registrations and use a password manager, which will not autofill on the wrong domain.

How CRACI limits the damage

CRACI does not detect new malicious packages by behavior or reputation, so use a package firewall or a behavior analysis tool for that. What it does is contain them. As your GitHub Actions runner, it enforces an egress policy that blocks connections your build does not need, so a package that steals secrets has nowhere to send them, even when nobody has seen the attack before. Every package a job fetched is on the record, so once an attack is known you can see which builds pulled it in, and releases with a published CVE are flagged and can be blocked by policy gates. See what is a supply chain attack.

Typosquatting: frequently asked questions

What is typosquatting in simple terms?

It is registering a name that looks almost like a popular one, such as a package or website, and waiting for someone to mistype it. The lookalike then delivers malware or steals credentials.

What is an example of typosquatting?

In 2017, the npm package crossenv imitated the popular cross-env. It worked like the real package and also sent users' environment variables to the attacker's server.

What is the difference between typosquatting and dependency confusion?

Typosquatting relies on a person mistyping a public package name. Dependency confusion uses the exact name of a private package, and relies on a build system fetching a public version instead.

Is typosquatting illegal?

Publishing malware or stealing credentials is illegal in most places. Domain typosquatting can also breach trademark law, such as the US Anticybersquatting Consumer Protection Act.

What is slopsquatting?

A variation in which an attacker registers a package name that AI assistants tend to invent. Anyone who installs the suggested package gets the attacker's code.

How do you detect typosquatting?

Review new dependencies by name and metadata, and use a tool that compares package names with popular ones or analyzes behavior. Advisory-based scanners only help once the package has been reported.