No obvious typosquatting packages
Why it matters
Typosquatting attacks exploit fast-typing or AI-assisted package installation: an attacker registers lodahs or crossenv on npm and waits for installations. These packages typically contain postinstall scripts that exfiltrate environment variables — specifically targeting AWS_SECRET_ACCESS_KEY, DATABASE_URL, and similar credentials that are almost universally present in developer environments. OWASP A08 (Software and Data Integrity Failures) and CWE-829 both apply. CWE-1357 covers the reliance on an insufficiently trustworthy component. AI coding tools that auto-generate npm install commands are particularly vulnerable to this vector because they may hallucinate a package name that closely resembles a real one. A single character transposition in a production dependency name can mean you're running attacker code.
Severity rationale
Medium because typosquatting requires the malicious package to be installed — the attacker depends on a typographic error — but the consequence when triggered is immediate credential exfiltration.
Remediation
Verify any unfamiliar package before using it. Check the registry record directly:
npm info suspect-package-name
Look for: number of published versions, publish date, author identity, README quality, and weekly download count. A package with one version, no README, and under 100 weekly downloads that resembles a popular library is a red flag. Remove the suspect package and install the correct spelling:
npm uninstall suspect-package-name
npm install correct-package-name
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Dependency & Supply Chain Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-829 — Inclusion of Functionality from Untrusted Control Sphere
- cwe · CWE-1357 — Reliance on Insufficiently Trustworthy Component
- owasp:2021 · A08 — Software and Data Integrity Failures
- ssdf:800-218 · PW.4 — Reuse Existing, Well-Secured Software
- soc2:2017 · CC6.8 — Prevention and detection of unauthorized or malicious software
Taxons
History
- 2026-04-18·v1.0.0·Initial import from dependency-supply-chain·automated
- 2026-07-06·v1.0.1·Add SOC 2 TSC mapping (CC6.8) from the verified compliance crosswalk register (docs/compliance/).·by soc2-mapping-enrichment-ship-2