Typosquatting and malicious packages

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which package name is an example of typosquatting a popular library called requests?

A reqeusts

B requests

2. What is the main aim of typosquatting?

A Slow down a server by sending it millions of requests

B Trick people who mistype a name into using a malicious package or site

3. You are about to type pip install requests. What is the safest habit?

A Install it quickly because a typo would be caught automatically

B Check the spelling of the package name before pressing Enter

4. True or false: a typosquatted package can only be harmful if it does not work at all.

A False

B True

5. Which is a typosquatting trick?

A Publishing a package named reqeusts to copy requests

B Publishing a package named requests-v2 with a new owner's real update notes

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1pip install reqeusts		Apip install requests # check spelling first
2pip install requests		BAssuming a near match is good enough. Typosquatting relies on look-alike names, and a missing letter can mean a fake package.
3Typosquatting publishes a malicious package with a name almost the same as a trusted one, hoping people use it by mistake.		CThe correct, trusted package name, spelled exactly as published by its real maintainers.
4Checking a package name means comparing it letter by letter with the official name before you install it.		DA possible typosquatting mistake: the name has swapped letters, so it may install a fake package instead of the real requests library.
5pip install reqeusts # looks fine, run it		EInstalling without checking the spelling. The name is a typo of requests, so it could be a malicious typosquatting package.
6pip install requets # close enough		Freqeusts vs requests

Definitions

typosquatting

Fill in the Blanks

Complete each line of code by filling in the missing parts.

pip _______ requests

pip install ________

pip ____ requests

name = "reqeusts" if name __ "requests": print("Check the name!")

trusted = "requests" name = "reqeusts" print(name == _______)

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A # requirements.txt

B flask==3.0.0

C reqeusts==2.31.0

D numpy==1.26.0

Question 2

A # Install the trusted package

B pip install nunpy

C import numpy

Question 3

A name = 'requests'

B ok = ['reqeusts', 'numpy']

C if name in ok:

D print('Name is trusted')

Question 4

A typed = 'reqeusts'

B real = 'reqeusts'

C if typed != real:

D print('Possible fake')

Question 5

A name = 'numpy'

B typed = 'nunpy'

C if typed == name:

D print('Check spelling')

Answer Key

Typosquatting and malicious packages

Section A: Quick Questions

A — reqeusts

B — Trick people who mistype a name into using a malicious package or site

B — Check the spelling of the package name before pressing Enter

A — False

A — Publishing a package named reqeusts to copy requests

Section B: Match the Pairs

pip install reqeusts → A possible typosquatting mistake: the name has swapped letters, so it may install a fake package instead of the real requests library.

pip install requests → The correct, trusted package name, spelled exactly as published by its real maintainers.

Typosquatting publishes a malicious package with a name almost the same as a trusted one, hoping people use it by mistake. → reqeusts vs requests

Checking a package name means comparing it letter by letter with the official name before you install it. → pip install requests # check spelling first

pip install reqeusts # looks fine, run it → Installing without checking the spelling. The name is a typo of requests, so it could be a malicious typosquatting package.

pip install requets # close enough → Assuming a near match is good enough. Typosquatting relies on look-alike names, and a missing letter can mean a fake package.

Section C: Definitions

typosquatting — Publishing a malicious package or site with a name almost the same as a trusted one, like reqeusts for requests, hoping people use it by mistake.

Section D: Fill in the Blanks

pip install requests

pip show requests

name = "reqeusts"
if name != "requests":
    print("Check the name!")

trusted = "requests"
name = "reqeusts"
print(name == trusted)

Section E: Spot the Error

C — The package name is misspelled as reqeusts, a typosquatting trap that could install a malicious look-alike. It should be requests==2.31.0.

B — nunpy is a look-alike name that could be a malicious typosquat. The trusted package is spelled numpy, so the line should be pip install numpy.

B — The trusted list contains the misspelled name reqeusts, so the check would trust a typosquat and fail the real package. It should list 'requests'.

B — The trusted name must be spelled correctly. With the typo in real, the typed name matches it and the typosquat is never flagged. It should be real = 'requests'.

C — The warning should show when the typed name is different from the trusted name. Using == warns only when the names match. It should be if typed != name:.