← Years 9–10 Digital Systems

Typosquatting and malicious packages

Publishing a malicious package or site with a name almost the same as a trusted one (like reqeusts for requests), hoping people install or visit it by mistake.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 67, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 42

Understanding Typosquatting and malicious packages in Years 9–10 Digital Systems

What it does: colourama is a near-copy of the real name colorama. This is the typosquatting pattern of a lookalike name waiting for a typing mistake. If an attacker publishes a public package named after a company's private package, the installer may fetch the public malicious copy instead of the private one. Typosquatting relies on a name that looks almost identical to a trusted one, so a quick typo leads to installing the wrong thing. Package managers install exactly the name you type. If an attacker has published that misspelt name, you get their code. A trusted package usually has a known publisher and a high download count. A typosquat often has a new, unknown publisher and very few downloads.

Common mistakes: The package name is misspelt as 'reqeusts'. That is a typosquatting trap, because an attacker may have published a malicious package with that name. It should be 'pip install requests'. 'crossenv' drops the hyphen from the real package 'cross-env'. Typosquatters use look-alike names like this. The correct line is 'npm install cross-env'.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Typosquatting and malicious packages to a class →

This module's key terms are also in a printable crossword (Modules 41–69) and word search (Modules 41–79).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which is an example of typosquatting?
Publishing a package called requests that is safe and has a new featurePublishing a malicious package called reqeusts to catch people trying to install requests
Matches
npm install lodsah # copied from memory, no check
↓
The name is misspelt (lodsah instead of lodash) and was not checked, so a typosquatted malicious package could be installed.
Applying
Meanings
Term
typosquatting
Meaning
Publishing a malicious package or site with a name almost the same as a trusted one (like reqeusts for requests), hoping people install or visit it by mistake.
Practice
pip show requests
Testing
Gaps
pip install
Check Answer
Spots
1pip install reqeusts
2pip show requests

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Deer' badge — Forest Streak, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which is an example of typosquatting?
A. Publishing a package called requests that is safe and has a new feature
B. Publishing a malicious package called reqeusts to catch people trying to install requests ✓
Typosquatting relies on a name that looks almost identical to a trusted one, so a quick typo leads to installing the wrong thing.
2. A developer types pip install reqeusts by accident. What is the risk?
A. They might install a malicious look-alike package instead of the real requests package ✓
B. pip will always fix the spelling and install the real requests package
Package managers install exactly the name you type. If an attacker has published that misspelt name, you get their code.
3. Which step helps you spot a malicious package?
A. Check the publisher and the download count before installing ✓
B. Pick whichever package appears first in the search results
A trusted package usually has a known publisher and a high download count. A typosquat often has a new, unknown publisher and very few downloads.
4. Why do attackers choose names like 'nunpy' or 'reqeusts'?
A. They make the malicious code run faster than the real package
B. They look almost the same as popular names, so people install them by mistake ✓
The name is the trick. Attackers count on typos and a quick glance not noticing the difference.
5. Which package name is most likely a typosquat of 'requests'?
A. reqeusts ✓
B. requests
'reqeusts' swaps two letters in the real name 'requests'. This is a classic misspelt package name.

Match the Pairs

pip install reqeusts → A typosquatting trap: the name is a misspelt version of the trusted package requests, so it could install malware by mistake
npm view express maintainers downloads → Checks who publishes a package and how popular it is before installing, to spot a fake lookalike
A misspelt package name is a typosquatting risk because it looks almost the same as a trusted one → pip install colourama
Dependency confusion: a public package uses the same name as a private internal one so the build installs the wrong one → pip install acme-internal-tools
npm install lodsah # copied from memory, no check → The name is misspelt (lodsah instead of lodash) and was not checked, so a typosquatted malicious package could be installed.
Installed it because it had 12 downloads and an unknown publisher → The student ignored warning signs: a very low download count and an unknown publisher suggest a fake lookalike package.

Key Term

typosquatting
Publishing a malicious package or site with a name almost the same as a trusted one (like reqeusts for requests), hoping people install or visit it by mistake.

Fill in the Blanks

1. # Trusted library for making web requests pip install requests
Hint: Type the correctly spelt name of the trusted library, not a lookalike.
2. # View the author before you trust it pip show requests
Hint: Type the pip command that displays details about a package, such as its author.
3. trusted ← "requests" IF package ≠ trusted THEN PRINT "Possible typosquat"
Hint: Type the operator that checks the two names are not equal.
4. IF downloads < 100 THEN PRINT "Low downloads, be careful" ENDIF
Hint: Type the comparison operator meaning fewer than, to flag packages few people use.
5. IF name IN ownPackages THEN get from private registry ENDIF
Hint: Type the kind of registry that should supply names our company owns, to stop dependency confusion.

Spot the Error

Question 1
A pip install reqeusts
B pip show requests
C pip list
Line A — The package name is misspelt as 'reqeusts'. That is a typosquatting trap, because an attacker may have published a malicious package with that name. It should be 'pip install requests'.
Question 2
A npm install crossenv
B npm view cross-env
C npm audit
Line A — 'crossenv' drops the hyphen from the real package 'cross-env'. Typosquatters use look-alike names like this. The correct line is 'npm install cross-env'.
Question 3
A trusted = 'requests'
B name = 'reqeusts'
C if name == trusted:
D print('Typosquat?')
Line C — The comparison is reversed. The warning should show when the name does NOT match the trusted name, so it should use !=.
Question 4
A downloads = 52000000
B publisher = 'psf'
C if downloads > 100:
D print('Suspicious')
Line C — A very low download count is a warning sign of a fake package. The check should use < so it flags packages with few downloads, not popular ones.
Question 5
A trusted = ['numpy', 'pandas']
B pkg = 'numpyy'
C print('Checking', pkg)
D if pkg not in trusted
E print('Do not install')
Line D — The if statement is missing its colon at the end. It should be 'if pkg not in trusted:' so the name 'numpyy' is flagged as not trusted.

Student with a class code? Join your class →