By Rushabh Shah, Senior Software Developer · 2026-08-25
Typosquatting is one of the best-documented supply-chain attack techniques — publish a package one keystroke away from something popular, wait for developers to fat-finger npm install, and you have a foothold with no CVE ever filed. What's less documented is a simple question: right now, today, how many of those look-alike names are actually sitting on the registry? So we checked every single-character typo (omit a letter, double a letter, swap two adjacent letters) of the 30 most popular packages on npm and the 30 most popular on PyPI, queried live against each registry's real API, then cross-referenced every hit against OSV.dev's public malicious-package database.
This mirrors the exact detection method DepWarden uses in production: Damerau-Levenshtein edit-distance matching against a curated list of high-popularity package names, narrowed here to the three typo patterns that account for the overwhelming majority of real-world typosquats — omission, duplication, and adjacent transposition. Every candidate was checked against the real registry API; every hit was queried against api.osv.dev for an associated advisory. Nothing here is inferred; every count is a live HTTP response, checked on 25 August 2026. A registered look-alike name alone isn't automatically malicious — short strings inevitably collide with unrelated legitimate packages — which is exactly why the OSV cross-reference is the finding that matters, not the raw registration count.
| Popular package | Confirmed-malicious typo variants found |
|---|---|
| request | 17 |
| lodash | 9 |
| express | 9 |
| chalk | 8 |
| commander | 8 |
| async | 8 |
| react | 7 |
| debug | 5 |
| bluebird | 5 |
| moment | 4 |
request — deprecated since 2020 but still enormously installed from years of accumulated dependents — tops the list by a wide margin, plausibly because the sheer volume of developers who've typed its name from memory over its lifetime is larger than for a younger package.
Alongside the typosquat check, we pulled real OpenSSF Scorecard scores for the same 60 popular packages. npm averaged 6.24/10 (20.7% below 5, 6.9% below 3); PyPI averaged 6.79/10 (10.0% below 5, none below 3). Lowest scores: bluebird (2.0), debug (2.6) and request (3.4) on npm; psycopg2 (3.7), setuptools (4.4) and httpx (4.9) on PyPI. Notably, bluebird and debug — two of the lowest Scorecard scores in the whole sample — also both appear in the confirmed-malicious-squat table above.
Single-character typing mistakes in npm install carry real, non-hypothetical, currently-live risk — at a rate higher than most developers would guess. PyPI's exposure to this specific technique is measurably lower. Three things help: pin exact versions in a lockfile, use a scanner that checks for typosquat-shaped names as a signal distinct from CVE matching (by definition, none of these 97 packages have a CVE), and treat an unfamiliar package with a suspiciously close name as worth a second look before installing. DepWarden runs this same detection — free, no account required — on every scan. Related: how npm typosquatting attacks work, detecting typosquats in CI.