# Typosquatting: lookalike package names and how to catch them > Typosquatting is publishing malware under a name close to a popular package. Real cases, the patterns attackers use, and how detection catches them. Source: https://chain305.com/learn/typosquatting/ --- # What is typosquatting? One letter off a popular package, and it runs at install. Two real typosquats nine years apart, the naming patterns attackers use, and how to catch a lookalike before it installs. By [Muhammad Zeeshan Sultan](https://chain305.com/about/#founder), founder of Chain305 · October 2026 Questions and answers ## What is typosquatting? Typosquatting is publishing a package under a name close to a popular one, so a person, a script or a dependency installs the lookalike by mistake. The name might drop a letter, swap two words, replace a hyphen with an underscore, or use a character which looks the same as the real one, as in `crossenv` for `cross-env` or `lodahs` for `lodash`. Typosquatting is an attack on public package registries such as npm, PyPI and crates.io, and the malicious code usually runs at install or build time, before anyone imports the package. In August 2026, for example, `proc-macro1` copied the name of the Rust crate `proc-macro2` and ran malware from its `build.rs` at compile time. Typosquats now often arrive as dependencies of a compromised package, so nobody has to mistype anything. ## What does a real typosquat look like? Two incidents, nine years apart, show the range. - **crossenv (npm, 2017).** An account called hacktask published `crossenv`, one of about 40 lookalikes of popular packages such as `cross-env`. The package worked as expected and also ran a setup script on install that sent the machine’s environment variables to the attacker. npm removed the packages and banned the account; it is tracked as CVE-2017-16074. - **proc-macro1 (crates.io, August 2026).** The name copies `proc-macro2`, one of Rust’s most used crates, and its author field was faked as David Tolnay, who maintains the real one. Nobody had to mistype anything: using a [maintainer’s compromised credentials](https://chain305.com/learn/maintainer-account-takeover/), the attacker added `proc-macro1` as a dependency of `arrayref`, `internment` and `append-only-vec`. Its `build.rs` ran malware at compile time. crates.io removed the malicious versions within two hours. The second case is the modern pattern. The lookalike is pulled in by a dependency, so reading your own `package.json` or `Cargo.toml` would not have shown it. ## What patterns do typosquats use? Typosquats use six naming patterns, and each pattern is a small edit to the name of a popular package. The 2017 npm typosquat `crossenv` dropped the hyphen from `cross-env`, for example, and the 2026 crates.io typosquat `proc-macro1` changed one digit of `proc-macro2`. Detection tools check for each pattern below. - **One-character edits:** a missing, extra or swapped letter (`lodahs`). - **Separators:** `cross-env` against `crossenv` or `cross_env`. - **Word order:** `parser-yaml` against `yaml-parser`. - **Lookalike characters:** a capital `I` for a lowercase `l`, or a Cyrillic letter that renders like a Latin one. - **Suffixes and scopes:** `requests2`, or an unscoped copy of a scoped package. - **Lookalike publishers:** an account name one edit away from a known maintainer. ## How is typosquatting detected? Typosquatting is detected by comparing every new or unfamiliar package name against the names people actually use. Edit distance is the check for one-character changes such as `lodahs` for `lodash`; a BK-tree makes the comparison fast against a large list of popular names. Normalising separators and case catches `cross_env`. A homoglyph table maps lookalike characters back to the letters they imitate. Sorting the words of a name catches reordered ones such as `parser-yaml`. A name match alone is weak evidence, because plenty of legitimate packages have similar names. Detection gets reliable when the name match is combined with other facts about the package: the package’s age, whether a real repository exists, its download count, and whether it runs code at install. Chainsaw, for example, combines BK-tree, homoglyph and word-reorder matchers with a rule refusing packages first published less than 1 day ago. ## How does Chainsaw handle typosquats? Chainsaw checks every install against BK-tree, homoglyph and word-reorder matchers across fifteen ecosystems, and a rule seeded into each new organisation refuses suspected typosquats. When we re-ran 58 attacks from 2026 against the production version on 19 October 2026, that rule would have refused `proc-macro1` on its first download. With the dependency refused, the builds of all three compromised crates would have failed for anyone installing through Chainsaw. When a legitimate package matches a popular name, you allow it once and the decision is recorded. The other defaults help here too: a brand-new lookalike is also caught by the rule that refuses packages first published less than a day ago. [The full list of signals.](https://chain305.com/product/policy/) ## Is typosquatting the same as slopsquatting? No. Typosquatting and [slopsquatting](https://chain305.com/slopsquatting/) are different attacks on the same moment, the install. Typosquatting is the older attack: a person mistypes a popular name, or an attacker inserts a lookalike such as `crossenv` for `cross-env` into a dependency tree. Slopsquatting relies on an AI coding tool inventing a package name, which an attacker then registers on a registry such as npm or PyPI and fills with malware. In a 2025 study (Spracklen et al., USENIX Security 2025), 19.7% of the packages recommended by code-generating models did not exist. Slopsquatting is typosquatting without the typo: the developer types the name exactly as the model suggested. Many invented names are still close variants of a real one, so typosquat matching catches some slopsquatted packages, and a hold on brand-new packages catches more, because a slopsquatted package is new by definition. ## Sources - npm, [crossenv malware on the npm registry](https://blog.npmjs.com/post/163723642530/crossenv-malware-on-the-npm-registry.html), August 2017. - JFrog Security Research, [Compromised Rust crates on crates.io silently execute malware at build time](https://research.jfrog.com/post/arrayref-proc-macro1-crates-io/), August 2026. - The Hacker News, [Rust supply chain attack puts build environments at risk](https://thehackernews.com/2026/08/rust-supply-chain-attack-puts-build.html), August 2026. - Spracklen et al., [We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs](https://arxiv.org/abs/2406.10279), USENIX Security 2025. Lookalikes arrive as dependencies ## Check every package name on the install path Start a free org in monitor mode and see which lookalike names Chainsaw would refuse in your dependency tree. [Start in monitor mode](https://chain305.com/chainsaw/signup) [Slopsquatting →](https://chain305.com/slopsquatting/)