By Rushabh Shah, Senior Software Developer · 2026-08-25
Typosquatting is one of the best-documented supply-chain attack techniques — publish a package one keystroke away from something popular, wait for developers to fat-finger npm install, and you have a foothold with no CVE ever filed. What's less documented is a simple question: right now, today, how many of those look-alike names are actually sitting on the registry? So we checked every single-character typo (omit a letter, double a letter, swap two adjacent letters) of the 30 most popular packages on npm and the 30 most popular on PyPI, queried live against each registry's real API, then cross-referenced every hit against OSV.dev's public malicious-package database.
This mirrors the exact detection method DepWarden uses in production: Damerau-Levenshtein edit-distance matching against a curated list of high-popularity package names, narrowed here to the three typo patterns that account for the overwhelming majority of real-world typosquats — omission, duplication, and adjacent transposition. Every candidate was checked against the real registry API; every hit was queried against api.osv.dev for an associated advisory. Nothing here is inferred; every count is a live HTTP response, checked on 25 August 2026. A registered look-alike name alone isn't automatically malicious — short strings inevitably collide with unrelated legitimate packages — which is exactly why the OSV cross-reference is the finding that matters, not the raw registration count.
| Popular package | Confirmed-malicious typo variants found |
|---|---|
| request | 17 |
| lodash | 9 |
| express | 9 |
| chalk | 8 |
| commander | 8 |
| async | 8 |
| react | 7 |
| debug | 5 |
| bluebird | 5 |
| moment | 4 |
request — deprecated since 2020 but still enormously installed from years of accumulated dependents — tops the list by a wide margin, plausibly because the sheer volume of developers who've typed its name from memory over its lifetime is larger than for a younger package.
The top-10 table is the interesting slice, but a study you cannot check is just an assertion. So here is all of it — every candidate name, whether the registry says it is published, and every advisory id attached to it.
Re-running the whole study on 5 September 2026, eleven days after the original pass, reproduced it closely: npm 483 candidates, 284 registered (58.8%), 99 carrying an advisory (34.9% of registered); PyPI 615 candidates, 52 registered (8.5%), zero carrying an advisory. The per-package ranking came back identical, request still first by a wide margin at 17. Counts move by a few points between runs because packages are published and unpublished and OSV adds advisories; the finding does not.
| Popular package | Candidates checked | Registered | With an OSV advisory |
|---|---|---|---|
| request | 20 | 20 | 17 |
| lodash | 17 | 17 | 9 |
| express | 17 | 17 | 9 |
| commander | 23 | 23 | 8 |
| chalk | 14 | 14 | 8 |
| async | 14 | 14 | 8 |
| react | 14 | 14 | 7 |
| bluebird | 23 | 23 | 5 |
| debug | 14 | 14 | 5 |
| moment | 17 | 17 | 4 |
| rimraf | 17 | 4 | 3 |
| axios | 14 | 10 | 2 |
| webpack | 20 | 6 | 2 |
| colors | 17 | 5 | 2 |
| semver | 17 | 4 | 2 |
| yargs | 14 | 14 | 1 |
| babel | 14 | 6 | 1 |
| typescript | 29 | 5 | 1 |
| prettier | 20 | 5 | 1 |
| uuid | 8 | 4 | 1 |
| mkdirp | 17 | 4 | 1 |
| minimist | 23 | 2 | 1 |
| dotenv | 17 | 1 | 1 |
| redux | 14 | 8 | 0 |
| vue | 8 | 8 | 0 |
| jest | 11 | 7 | 0 |
| rxjs | 11 | 5 | 0 |
| next | 11 | 5 | 0 |
| glob | 11 | 5 | 0 |
| eslint | 17 | 3 | 0 |
Alongside the typosquat check, we pulled real OpenSSF Scorecard scores for the same 60 popular packages. npm averaged 6.24/10 (20.7% below 5, 6.9% below 3); PyPI averaged 6.79/10 (10.0% below 5, none below 3). Lowest scores: bluebird (2.0), debug (2.6) and request (3.4) on npm; psycopg2 (3.7), setuptools (4.4) and httpx (4.9) on PyPI. Notably, bluebird and debug — two of the lowest Scorecard scores in the whole sample — also both appear in the confirmed-malicious-squat table above.
Single-character typing mistakes in npm install carry real, non-hypothetical, currently-live risk — at a rate higher than most developers would guess. PyPI's exposure to this specific technique is measurably lower. Three things help: pin exact versions in a lockfile, use a scanner that checks for typosquat-shaped names as a signal distinct from CVE matching (by definition, none of these 97 packages have a CVE), and treat an unfamiliar package with a suspiciously close name as worth a second look before installing. DepWarden runs this same detection — free, no account required — on every scan. Related: how npm typosquatting attacks work, detecting typosquats in CI.