Skip to main content

Similarly Named Packages (Typosquatting)

Package "typosquatting" is a malicious activity where an attacker uploads packages that have similar names to existing popular packages in the registry. Once the malicious package is in the registry, the attacker relies on human error or social engineering so that people will install their package.

These malicious packages can run the attacker's code on a developer's workstation, within a CI setup, or possibly in a staging or production environment. This can be used to perform malicious actions within the developer's application or environment. The malicious package may introduce vulnerabilities, exfiltrate sensitive information, or move laterally through the developer's network.

Examples​

Attackers may take advantage of common typos. For example, an attacker may publish a package named "nxet" to take advantage of people who mistype the command to install the popular next package. If someone accidentally types npm install nxet, the attacker's package will be installed.

Attackers may also take advantage of visual similarities. For example, an attacker may publish a package named "tensorf1ow" to take advantage of the fact that the number 1 and the lower-case letter l can be difficult to distinguish. An attacker may then open a pull request that appears to upgrade the version of tensorflow, but instead changes the dependency to the attacker's "tensorf1ow" package. If someone merges that pull request, the attacker's package will now be used as a dependency.

How Trusty combats typosquatting​

Trusty analyzes the packages in a registry and identifies packages with similar names, using calculations like a Levenshtein distance. When this information is combined with the Trusty Score for each package, Trusty can build a list of packages with similar names but low scores. These packages with similar names and low Trusty Scores may be attempts at typosquatting.

Using Trusty's Visual Studio Code plug-in can help you identify packages with low Trusty Scores and potential typosquatting attacks at the moment that you import a package.