Typosquatting
A malicious package or website with a nearly correct name, waiting for someone to mistype or skim past the difference.
See it
What it is
Typosquatting registers a package or domain whose name is close enough to a trusted one that a rushed person chooses the wrong thing. The difference may be a missing letter, swapped characters, an extra hyphen, or a lookalike character. In 2017, the malicious npm package 'crossenv' copied the name of the legitimate 'cross-env' package and stole environment variables.
Watch for it when adding dependencies, following login links, and registering a product's main domains. Copy package names from the publisher's official documentation, inspect the owner and repository before install, and let lockfile changes receive the same review as source code.
The gotcha is that package managers install the misspelling perfectly. A valid TLS certificate also proves control of a lookalike domain, not that it belongs to the brand you meant. Similarity checks can surface candidates, but they also produce innocent matches, so confirm identity with provenance, ownership, publish history, and the expected domain.
Ask AI for it
Audit this repository for typosquatting in package manifests, lockfiles, download URLs, OAuth redirect hosts, and external links. Compare each package and domain with its expected upstream using Levenshtein distance and Unicode TR39 confusable skeletons, but treat similarity only as a review signal. For every close match, verify the npm registry owner, repository URL, publish history, install scripts, resolved tarball host, and lockfile integrity hash; for domains, verify the registrable domain and certificate names. Remove or replace confirmed impostors, rotate any secret exposed to their code or site, and add an allowlist check for approved package scopes and download domains to CI.