In February 2021, security researcher Alex Birsan described how he deployed malicious packages to the internal build systems of Apple, Microsoft, PayPal, Shopify and 32 other companies — without hacking a server, exploiting a CVE, or phishing anyone. He published packages to npm, PyPI and RubyGems with names matching internal packages those companies used, and their build systems installed his public versions automatically. This is dependency confusion — a vulnerability in the resolution logic of package managers, not in any package. CVE-based scanners miss it entirely.
Typosquatting exploits the fact that developers type package names by hand. Publish expresss to npm (three s's) and anyone who makes that common typo pulls down whatever you put in the package. With a convincing README, a few hundred weekly downloads from bots, and a malicious postinstall script, you have a stealthy credential-stealing payload reaching developer machines and CI pipelines. The postinstall script runs automatically when the package installs — before you have had a chance to read the code. Real examples include crossenv (typosquat of cross-env that stole environment variables), loadsh (typosquat of lodash) and multiple reqeusts variants targeting Python's requests library.
Dependency confusion exploits a logic flaw in private registry configurations. Most configurations check the public registry if the private one doesn't have a package — or check both and take the highest version. The attack: find the name of an internal package (often visible in job postings or error messages), publish a public package with the same name at a very high version number (such as 99.0.0), and wait for build systems to install the "newer" public version. The fix is to scope all internal packages under a private namespace and configure the registry to block public packages in that namespace.
CVE-based scanners cannot catch these attacks because there is no CVE. Typosquat detection uses edit-distance algorithms (Damerau-Levenshtein) to find packages in your dependency tree whose names are suspiciously close to popular packages but aren't those packages. Install-script presence is a risk signal — legitimate packages rarely need postinstall. Version anomalies (jumping from 1.0.4 to 99.0.0) and recent publish with zero dependents are classic markers. DepWarden flags typosquats using edit-distance checks against popular packages in each ecosystem and surfaces install-script, maintainer-change and version-anomaly signals alongside OSV/KEV/EPSS vulnerabilities. These attacks happen before a CVE is filed, if one ever is — the only defence is catching the suspicious signal upstream. Read also: catching typosquats in CI.