Typosquatting in npm: Risks to JavaScript Apps

This article provides an overview of typosquatting attacks targeting the npm registry, detailing how malicious actors exploit common developer mistakes to distribute malware across the JavaScript ecosystem. It examines the mechanics of package impersonation, how malicious scripts execute during installation and runtime, the primary threats posed to enterprise environments, and actionable strategies developers can implement to safeguard their software supply chains.

Understanding npm Typosquatting

Typosquatting is a software supply chain attack where an adversary publishes a malicious package with a name deliberately similar to a popular, legitimate library on the npm registry. Attackers rely on common human errors, such as typographical errors, misspellings, swapped letters, or alternate separators (e.g., uploading crossenv instead of cross-env, or lod-ash instead of lodash).

When a developer inadvertently types the misspelled package name during an npm install command, or mistakenly includes it in their package.json file, npm retrieves and integrates the malicious module into the application’s dependency tree without raising an innate syntax or installation error.

How Typosquatting Exposes Applications to Malware

Once a typosquatted package is fetched, it can compromise the host machine and the application through several attack vectors:

1. Automatic Execution via Lifecycle Scripts

npm allows packages to run automated scripts during the installation lifecycle using hooks such as preinstall, install, and postinstall. Malicious authors leverage these hooks to execute arbitrary code the moment npm install <package-name> runs, even before the developer imports or executes the package in their source code.

2. Environment Variable and Secret Theft

JavaScript applications and build pipelines frequently handle sensitive secrets, such as API keys, database credentials, SSH keys, and cloud deployment tokens (e.g., AWS, GitHub, or npm tokens). Malware embedded in a typosquatted dependency can automatically read process.env or local files (such as ~/.npmrc or ~/.ssh/id_rsa) and exfiltrate this data to an attacker-controlled remote server.

3. Backdoors and Remote Code Execution

Malicious dependencies can inject backdoors directly into the runtime of a Node.js or browser application. By monkey-patching core libraries or network methods, attackers can alter application logic, capture user input (such as passwords and credit card details), or establish reverse shells that grant persistent access to the host infrastructure.

4. Cryptomining and Botnet Enrollment

In some instances, typosquatted packages install silent cryptominers or turn host servers into botnet nodes, consuming CPU resources and degrading application performance.

Best Practices for Prevention