Also known as: package typosquatting · URL typosquatting
Typosquatting is the practice of registering package names or domains that closely resemble legitimate ones, relying on user typos or inattention to deliver malicious content to victims who intended to reach the real thing.
In package ecosystems this is especially effective because installation commands are typed frequently and reviewed rarely, and because a malicious package can execute arbitrary code during installation before anyone inspects it.
Registry operators have deployed automated similarity detection, but the space of plausible near-misses is enormous. Lockfiles and dependency review remain the practical defence at the consuming end.
Dependency Confusion
Dependency confusion is a supply chain attack in which an attacker publishes a malicious package to a public registry using the same name as an organisation's internal private package, causing build tooling to fetch the attacker's version instead.
Supply Chain Attack
A supply chain attack compromises an organisation indirectly by targeting a trusted supplier, dependency, or software update mechanism, so that malicious code arrives through a channel the victim already trusts.
Package Manager
A package manager is the tool that installs, updates, configures, and removes software on a Linux system, resolving dependencies automatically and verifying package integrity through cryptographic signatures.
Phishing
Phishing is a social-engineering attack in which an adversary impersonates a trusted party — typically via email, SMS, or a cloned website — to trick a victim into revealing credentials, authorising a payment, or installing malware.