Typosquatting
Named by 31 kept items in this workspace.
28 items name it under techniques and 3 under classification.key entities.
Search every workspace for Typosquatting. It matches the name as written, so it can find other things that share it.
The items that name it 31
42 malicious packages published as typosquats of legitimate crypto/web3 RubyGems packages
kreuzwenker/docker is a typosquat of the popular kreuzwerker/docker Terraform provider
Related supply chain attack distinguished from slopsquatting in the page's comparison table; involves a human misspelling a package name (contrasted with slopsquatting where no human mistyped anything)
Publishing proc-macro1 as a typosquat of the legitimate proc-macro2 package
proc-macro1 typosquats the legitimate proc-macro2 crate to be added as a dependency.
proc-macro1 typosquats the widely used proc-macro2 crate, copying its description, author name, and documentation to appear genuine
Publishing packages with names similar to popular packages (chalk, commander, lodash, typescript, react, axios on npm; bundler, i18n, rake, activesupport on RubyGems) to trick victims into installing malware
Publishing clumsy misspellings of popular Ruby gems (bundler, i18n, rake, activesupport) to catch mistyped 'gem install' commands
typo-crypto package described as a typosquat published by DPRK to lure developers installing a misspelled package name.
Lazy typosquats predicted to be caught by the new pre-publish scanner
Contrasted technique: registering names a character off from popular packages to exploit human typos (e.g. lodahs for lodash), distinct from slopsquatting's exploitation of AI-generated fabrications
AI assistant recommends an existing but malicious package, such as a typosquat, that a developer trusts and installs
Registering packages with names a single character off from popular libraries (e.g. lodahs vs lodash) so a developer who mistypes or miscopies a name installs the malicious version
Package Newtonsoftt.Json.Net (double t, .Net suffix) impersonates Newtonsoft.Json, with forged author, project URL, title and license metadata.
Using blatantly misspelled package names; caught reliably by agents
Fraudulent website impersonating the legitimate DeBank domain to deceive both AI agents and human users
Registering a lookalike domain (debank[.]auction) impersonating a legitimate service (DeBank) to deceive users and AI agents
Publishing packages with names mimicking popular Paysafe, Skrill, and Neteller payment SDKs to trick developers into installing them
Package ID Braintree.Net mimics official Braintree package name; similarly SipNet and SipNet.OpenAI.Realtime typosquat SIPSorcery ecosystem
Malicious packages mimic popular package names (e.g., lodahs instead of lodash) relying on a mistyped install command.
Package names/scopes crafted to closely resemble legitimate AI-ecosystem and security packages (e.g. @langgraphjs/toolkit vs @langchain/langgraph, @aspect-security/argon2 vs argon2)
Fake/typo-squatted packages typically identifiable by low install counts
easy-day-js published as a typosquat of the popular dayjs library to be pulled in as a transitive dependency
Malicious packages published under names closely resembling legitimate ones
Publishing packages with names similar to legitimate ones; associated with lower-download-count malicious packages and exemplified by the Events Channel package
A malicious package uses a name similar to a legitimate one to trick developers or automated systems into installing it instead; packages are increasingly published as benign initially to evade detection before threat actors push a malicious update.
Malicious extensions mimicking legitimate ones with slightly altered names to trick developers into installing them; detected via Risk Type: Typosquat filter
Multi-ecosystem typosquatting attack; PyPI typosquats
All techniques in this workspace.