Typosquatted Package.

A malicious open-source package published under a name that closely resembles a popular library so that developers install it by mistake. It belongs to the Attacks & Threats category of cybersecurity.

A malicious open-source package published under a name that closely resembles a popular library so that developers install it by mistake.

Typosquatted packages target the ecosystem-level autocomplete habits of developers. The attacker picks a widely used library — react, lodash, requests, cross-env, urllib3 — and publishes a malicious package with a tiny variation in the name (crossenv vs cross-env, python3-dateutil vs python-dateutil) on npm, PyPI, RubyGems, or NuGet. When a developer mistypes, copies bad documentation, or relies on AI suggestions, the malicious package is installed and its post-install or import code runs payloads that steal tokens, plant backdoors, or drain crypto wallets. Defences include lockfiles, package allow-lists, dependency-review tools (Socket, Snyk, GitHub Dependency Review), strict CI policies for new dependencies, and registry-side namespace protections.

Defences for Typosquatted Package typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Package typosquatting, Name-confusion attack.