Typosquatting
Publishing a malicious package, or registering a domain, under a name that is a plausible misspelling or variant of a popular one, such as reqeusts for requests, to catch mistyped installs and copied commands.
- Also called
- typosquat
- Defined in
- OWASP CICD-SEC-3: Dependency Chain Abuse
Covered in
Guide
Stop dependency confusion and typosquatting at install time
Pin every internal package name to its real source, verify installed bytes against a lockfile, and delay or gate install scripts so a public look-alike cannot replace a private dependency.
Guide
Investigate a suspected malicious package safely
Distinguish package substitution, publisher compromise and dangerous installation behavior while containing exposure and preserving evidence.