What is typosquatting?

Questions and answers

What is typosquatting?

Typosquatting is publishing a package under a name close to a popular one, so a person, a script or a dependency installs the lookalike by mistake. The name might drop a letter, swap two words, replace a hyphen with an underscore, or use a character which looks the same as the real one, as in crossenv for cross-env or lodahs for lodash. Typosquatting is an attack on public package registries such as npm, PyPI and crates.io, and the malicious code usually runs at install or build time, before anyone imports the package. In August 2026, for example, proc-macro1 copied the name of the Rust crate proc-macro2 and ran malware from its build.rs at compile time. Typosquats now often arrive as dependencies of a compromised package, so nobody has to mistype anything.

What does a real typosquat look like?

Two incidents, nine years apart, show the range.

• crossenv (npm, 2017). An account called hacktask published crossenv, one of about 40 lookalikes of popular packages such as cross-env. The package worked as expected and also ran a setup script on install that sent the machine’s environment variables to the attacker. npm removed the packages and banned the account; it is tracked as CVE-2017-16074.
• proc-macro1 (crates.io, August 2026). The name copies proc-macro2, one of Rust’s most used crates, and its author field was faked as David Tolnay, who maintains the real one. Nobody had to mistype anything: using a maintainer’s compromised credentials, the attacker added proc-macro1 as a dependency of arrayref, internment and append-only-vec. Its build.rs ran malware at compile time. crates.io removed the malicious versions within two hours.

The second case is the modern pattern. The lookalike is pulled in by a dependency, so reading your own package.json or Cargo.toml would not have shown it.

What patterns do typosquats use?

Typosquats use six naming patterns, and each pattern is a small edit to the name of a popular package. The 2017 npm typosquat crossenv dropped the hyphen from cross-env, for example, and the 2026 crates.io typosquat proc-macro1 changed one digit of proc-macro2. Detection tools check for each pattern below.

• One-character edits: a missing, extra or swapped letter (lodahs).
• Separators: cross-env against crossenv or cross_env.
• Word order: parser-yaml against yaml-parser.
• Lookalike characters: a capital I for a lowercase l, or a Cyrillic letter that renders like a Latin one.
• Suffixes and scopes: requests2, or an unscoped copy of a scoped package.
• Lookalike publishers: an account name one edit away from a known maintainer.

How is typosquatting detected?

Typosquatting is detected by comparing every new or unfamiliar package name against the names people actually use. Edit distance is the check for one-character changes such as lodahs for lodash; a BK-tree makes the comparison fast against a large list of popular names. Normalising separators and case catches cross_env. A homoglyph table maps lookalike characters back to the letters they imitate. Sorting the words of a name catches reordered ones such as parser-yaml.

A name match alone is weak evidence, because plenty of legitimate packages have similar names. Detection gets reliable when the name match is combined with other facts about the package: the package’s age, whether a real repository exists, its download count, and whether it runs code at install. Chainsaw, for example, combines BK-tree, homoglyph and word-reorder matchers with a rule refusing packages first published less than 1 day ago.

How does Chainsaw handle typosquats?

Chainsaw checks every install against BK-tree, homoglyph and word-reorder matchers across fifteen ecosystems, and a rule seeded into each new organisation refuses suspected typosquats. When we re-ran 58 attacks from 2026 against the production version on 19 October 2026, that rule would have refused proc-macro1 on its first download. With the dependency refused, the builds of all three compromised crates would have failed for anyone installing through Chainsaw.

When a legitimate package matches a popular name, you allow it once and the decision is recorded. The other defaults help here too: a brand-new lookalike is also caught by the rule that refuses packages first published less than a day ago. The full list of signals.

Is typosquatting the same as slopsquatting?

No. Typosquatting and slopsquatting are different attacks on the same moment, the install. Typosquatting is the older attack: a person mistypes a popular name, or an attacker inserts a lookalike such as crossenv for cross-env into a dependency tree. Slopsquatting relies on an AI coding tool inventing a package name, which an attacker then registers on a registry such as npm or PyPI and fills with malware. In a 2025 study (Spracklen et al., USENIX Security 2025), 19.7% of the packages recommended by code-generating models did not exist. Slopsquatting is typosquatting without the typo: the developer types the name exactly as the model suggested. Many invented names are still close variants of a real one, so typosquat matching catches some slopsquatted packages, and a hold on brand-new packages catches more, because a slopsquatted package is new by definition.

Sources

• npm, crossenv malware on the npm registry, August 2017.
• JFrog Security Research, Compromised Rust crates on crates.io silently execute malware at build time, August 2026.
• The Hacker News, Rust supply chain attack puts build environments at risk, August 2026.
• Spracklen et al., We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs, USENIX Security 2025.