What Is a Typosquatting Attack and How to Stop It

A typosquatting attack publishes something with a name very close to a popular package or domain, so a typo or a rushed copy and paste delivers the attacker's version instead. In software, the payload often runs through an install script. You stop it by checking names exactly, using lockfiles and disabling install scripts by default.

Key takeaways

• Attackers rely on small mistakes: swapped letters, missing hyphens, extra characters.
• On npm, install scripts let the payload run before you read any code.
• Copy install commands from official docs and review every new dependency name.
• Disable install scripts by default and scan for suspicious behavior, since a brand new fake has no CVE.

What does a typosquatting attack look like in practice?

The attacker registers a name that resembles a well known package. If you mistype the real name, or follow a bad tutorial, the package manager installs the lookalike.

One often cited npm example is crossenv, published with a name similar to a popular package. According to a write up we reviewed, it captured environment variables and sent them to an attacker-controlled server, using the postinstall script to do it. Environment variables often hold tokens and keys, which is why this pays off.

Why does typosquatting work so well on package registries?

Two reasons. Package names are short, so one wrong letter still produces a valid name. And npm runs lifecycle scripts on install: the npm documentation lists preinstall, install and postinstall. The script runs with your permissions, often for a transitive dependency, before anyone reviews the code.

AI coding assistants add a new twist. If an assistant suggests a package name that does not exist, an attacker can register it. Always confirm that a suggested package is real before you install it.

What name tricks should I look for?

• A swapped or doubled letter in the name
• A missing or added hyphen or underscore
• A familiar word added to a real name, such as a suffix like core or utils
• A different scope, or no scope, where the real package has one
• A very new package with few versions and a single unknown maintainer

How do I stop typosquatting?

1. Copy, do not type. Take the install command from the project's official README.
2. Compare the name letter by letter on the registry page, and check maintainers and release history.
3. Commit a lockfile and install from it, so a lookalike cannot appear by accident.
4. Set ignore-scripts to true. It is false by default. Allow scripts only for packages that need native builds.
5. Scan new dependencies. An advisory database such as npm audit will not know a fresh fake, so also use behavior checks and malicious package lists.
6. Review pull requests that add dependencies, the way you review code.

For a longer walk through, see how to check if an npm package is safe.

The demo below shows how malware and typosquats are flagged in a dependency list.

Click through it at your own pace, or open it full screen.

You can also check a dependency file for free at gold.safeguard.sh/scan. It needs no login, the file stays on your machine, and it covers up to 100 dependencies. The Gold registry lists malicious package flags.

Frequently asked questions

Sources

• npm Docs: scripts
• npm Docs: reporting malware in an npm package
• Dive into npm supply chain attack (blog write up of crossenv and install scripts)
• Safeguard Gold dependency scan

Last reviewed: 19 October 2026.