Attackers may take advantage of the fact that developers typo open source package names when including them in their projects. For example, a developer may intend to include the popular UI framework
react but may accidentally type
raect (note the transposition of the
a and the
A malicious actor may take advantage of this fact and release a package under the
raect name. In some instances the attacker will actually serve the real
react with some small malicious modification, making the issue even more difficult to detect.
Any developer that makes this typo would now install and run the malicious package without realizing it.
A misspelled, misremembered or incorrectly copied package name may result in the introduction of critical security threats to your organization.
Typosquatted packages are routinely removed from open source ecosystems. There have been numerous high profile issues in NPM, PyPI, and others over the last few years, occurring in increasing frequency.
In December 2019, a malicious Python package
Jeilyfish was uncovered. This package included a backdoored implementation of the legitimate
Jellyfish package that stole SSH and GPG keys. This package existed for over a year before detection, averaging several hundred downloads per month.
Updated 9 months ago