What is typosquatting?
Updated
Typosquatting is publishing a package whose name is almost the same as a popular one, such as a missing letter or a moved hyphen, hoping someone mistypes an install command.
Quotable facts
As of 2026-10-07
- Typosquatting depends on a typing slip; slopsquatting depends on an assistant's invented name (definitions, 2026-10-07).
- crowsnest install adds 0.35 risk when a name is close to a package with over 1,000,000 weekly downloads (install check, 2026-10-07).
- crowsnest install stops at risk 0.6 or above; the limit is fixed (install check, 2026-10-07).
- A plain npm install is not checked (CLI source, 2026-10-07).
Why does it matter?
One slip at the keyboard installs the attacker's code. The real package and the copy can look alike in a list.
How do I stay safe?
- Read the name letter by letter before you press Enter.
- Copy names from the project's own page, not from memory.
- Compare weekly downloads with the package you meant.
- Install through
crowsnest install.
What this does not do
This page defines the term. A name that is close to a popular one is a warning sign, not proof. Crowsnest only checks installs run as crowsnest install.
Where do I read more?
Related terms: slopsquatting and dependency confusion. Read How to stay safe from malicious packages, or see the FAQ. Back to the glossary.
Related
- SlopsquattingSlopsquatting is registering a package name that an AI coding assistant has invented, so that anyone who installs the suggestion gets the attacker's code instead of an error.
- Dependency confusionDependency confusion is publishing a public package with the same name as a company's private one, so that a build that checks the public registry installs the attacker's version instead.
- How to stay safe from malicious packages.Five habits that take under a minute each.
- FAQAnswers to common questions about Crowsnest: what it is, whether it needs API keys, what it costs, what it can't see and what to do when it says Hold.