Typosquatting: One Letter from a Compromise
How lookalike packages land in real builds, the install-script trick that makes them instant, and the small habits that catch them at review.
Short answer
Typosquatting publishes a malicious package under a name similar to a popular one. A single typo in package.json can run install scripts as CI. Copy names from official docs.
How it lands
Lookalike names, install scripts, and rushed PRs.
Review new dependencies like you review new users with admin rights - because install scripts often get that power.
Readers skimming typosquatting packages often stop at definitions. The part that prevents incidents is the verification step after the change - and the habit of re-checking after the next deploy that touches the same layer.
Habits that catch it
Copy package names from official docs, lockfiles required, alert on new dependencies, disable lifecycle scripts in CI when feasible.
Speed is not a virtue when the package name is wrong by one character.
Common failure mode for typosquatting packages: staging looks fine, production still serves the old config because a CDN, load balancer, or second vhost was never updated. Always verify the hostname customers hit.
After a bad install
Treat it as a compromise: rotate secrets the CI could reach, inspect what the script did, rebuild from known-good lockfiles.
Do not "just remove the line" and hope.
If this section on typosquatting packages becomes a recurring ticket, automate the check. Manual one-offs rot; a post-deploy assertion or weekly grade keeps the control honest.
What to do this week
- Audit recent new dependencies for lookalike names.
- Require lockfiles; ban floating versions on critical apps.
- Disable or review lifecycle scripts in CI.
- Document the "copy from official docs" rule for the team.
One letter. Full compromise. Slow down on new dependencies.
Update log (1)
2026-06-29Editorial form rewrite for length and uniqueness.
Sources + verification
Practical guidance based on mainstream browser behavior, common reverse-proxy configuration, and widely published RFCs and vendor docs. Verify on your own stack with curl, browser devtools, and a re-scan after each change.
