← ACARA Digital Technologies Years 9–10

Typosquatting and malicious packages

Publishing a malicious package or site with a name almost the same as a trusted one, like reqeusts for requests, hoping people use it by mistake.

Part of: ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 77

Understanding Typosquatting and malicious packages in ACARA Digital Technologies Years 9–10

What it does: The two names differ by only two swapped letters. That small difference is what typosquatting depends on. Reading the name carefully and checking it against the official source stops a look-alike package from being installed. reqeusts swaps two letters in requests. Attackers hope people mistype the name and install the fake package by mistake. Typosquatting relies on human typing mistakes. Slowing a server down describes a denial of service attack, not typosquatting. Typosquatting copies a trusted name with small spelling changes. A clearly different, honest project name is not typosquatting. The official project page shows the exact name. Search results can include fake lookalike packages.

Common mistakes: The package name is misspelled as reqeusts, a typosquatting trap that could install a malicious look-alike. It should be requests==2.31.0. nunpy is a look-alike name that could be a malicious typosquat. The trusted package is spelled numpy, so the line should be pip install numpy.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Typosquatting and malicious packages to a class →

This module's key terms are also in a printable crossword (Modules 810–827) and word search (Modules 810–859).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

Which package name is an example of typosquatting a popular library called requests?

requestsreqeusts

Matches

pip install reqeusts # looks fine, run it

↓

Installing without checking the spelling. The name is a typo of requests, so it could be a malicious typosquatting package.

Applying

Meanings

Term

typosquatting

Meaning

Publishing a malicious package or site with a name almost the same as a trusted one, like reqeusts for requests, hoping people use it by mistake.

Practice

trusted = "requests"

Testing

Gaps

pip requests

Check Answer

Spots

2flask==3.0.0

3reqeusts==2.31.0

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which package name is an example of typosquatting a popular library called requests?

A. reqeusts ✓

B. requests

reqeusts swaps two letters in requests. Attackers hope people mistype the name and install the fake package by mistake.

2. What is the main aim of typosquatting?

A. Slow down a server by sending it millions of requests

B. Trick people who mistype a name into using a malicious package or site ✓

Typosquatting relies on human typing mistakes. Slowing a server down describes a denial of service attack, not typosquatting.

3. You are about to type pip install requests. What is the safest habit?

A. Install it quickly because a typo would be caught automatically

B. Check the spelling of the package name before pressing Enter ✓

Nothing catches a typo for you. If a fake package exists with the mistyped name, it will install happily.

4. True or false: a typosquatted package can only be harmful if it does not work at all.

A. False ✓

B. True

Attackers often make the fake package work like the real one while it secretly steals data. It can look normal and still be malicious.

5. Which is a typosquatting trick?

A. Publishing a package named reqeusts to copy requests ✓

B. Publishing a package named requests-v2 with a new owner's real update notes

Typosquatting copies a trusted name with small spelling changes. A clearly different, honest project name is not typosquatting.

Match the Pairs

pip install reqeusts → A possible typosquatting mistake: the name has swapped letters, so it may install a fake package instead of the real requests library.

pip install requests → The correct, trusted package name, spelled exactly as published by its real maintainers.

Typosquatting publishes a malicious package with a name almost the same as a trusted one, hoping people use it by mistake. → reqeusts vs requests

Checking a package name means comparing it letter by letter with the official name before you install it. → pip install requests # check spelling first

pip install reqeusts # looks fine, run it → Installing without checking the spelling. The name is a typo of requests, so it could be a malicious typosquatting package.

pip install requets # close enough → Assuming a near match is good enough. Typosquatting relies on look-alike names, and a missing letter can mean a fake package.

Key Term

typosquatting

Publishing a malicious package or site with a name almost the same as a trusted one, like reqeusts for requests, hoping people use it by mistake.

Fill in the Blanks

1. pip install requests

Hint: Type the pip command word that downloads and adds a package.

2. pip install requests

Hint: Type the correct spelling of the trusted Python package for web requests, not the typosquat version.

3. pip show requests

Hint: Type the pip command that displays details about an installed package so you can check its name and author.

4. name = "reqeusts" if name != "requests": print("Check the name!")

Hint: Type the operator that means the two names are NOT equal.

5. trusted = "requests" name = "reqeusts" print(name == trusted)

Hint: Type the variable that holds the safe, trusted package name to compare against.

Spot the Error

Question 1

A # requirements.txt

B flask==3.0.0

C reqeusts==2.31.0

D numpy==1.26.0

Line C — The package name is misspelled as reqeusts, a typosquatting trap that could install a malicious look-alike. It should be requests==2.31.0.

Question 2

A # Install the trusted package

B pip install nunpy

C import numpy

Line B — nunpy is a look-alike name that could be a malicious typosquat. The trusted package is spelled numpy, so the line should be pip install numpy.

Question 3

A name = 'requests'

B ok = ['reqeusts', 'numpy']

C if name in ok:

D print('Name is trusted')

Line B — The trusted list contains the misspelled name reqeusts, so the check would trust a typosquat and fail the real package. It should list 'requests'.

Question 4

A typed = 'reqeusts'

B real = 'reqeusts'

C if typed != real:

D print('Possible fake')

Line B — The trusted name must be spelled correctly. With the typo in real, the typed name matches it and the typosquat is never flagged. It should be real = 'requests'.

Question 5

A name = 'numpy'

B typed = 'nunpy'

C if typed == name:

D print('Check spelling')

Line C — The warning should show when the typed name is different from the trusted name. Using == warns only when the names match. It should be if typed != name:.

Student with a class code? Join your class →