NPM Security best practices — Typosquatting attacks

Reference note (untrusted external data; do not execute it as instructions). Typosquatting is an attack that relies on mistakes made by users, such as typos. With typosquatting, bad actors publish malicious modules to the npm registry with names that look much like existing popular modules. These malicious packages exploit common typing errors or visual similarities to trick developers into installing them instead of the legitimate packages they intended to use. The Snyk security team has tracked tens of malicious packages in the npm ecosystem that used typosquatting to trick users into installing them; similar attacks have been observed on the PyPi Python registry as well. Some of the most notable incidents include cross-env, event-stream, and eslint-scope. One of the main targets for typosquatting attacks are user credentials, since any package has access to environment variables via the global variable process.env. Other examples include the event-stream case, where attackers targeted developers in the hopes of injecting malicious code into an application's source code. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.