Glossary
Typosquatting
Typosquatting publishes a malicious package under a name deceptively close to a genuinely popular one — a single transposed letter, a common misspelling, a plausible-looking alternate separator — hoping someone installs it by accident, having mistyped or misremembered the name of the package they actually meant to install. This doesn't require compromising any legitimate maintainer's account at all; the attacker simply publishes a new package of their own under a name close enough to fool a rushed or careless install command.
The attack succeeds purely on the strength of a naming collision and ordinary human error, which makes it difficult to close through security review of any specific package — the fake package itself may otherwise contain nothing that looks obviously suspicious on inspection. Defending against it generally relies on tooling that flags suspiciously similar names at install time, and on the ecosystem's own registry actively watching for names that closely resemble established, popular packages.