Typosquatting and malicious packages

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which is an example of typosquatting?

A Publishing a package called requests that is safe and has a new feature

B Publishing a malicious package called reqeusts to catch people trying to install requests

2. A developer types pip install reqeusts by accident. What is the risk?

A They might install a malicious look-alike package instead of the real requests package

B pip will always fix the spelling and install the real requests package

3. Which step helps you spot a malicious package?

A Check the publisher and the download count before installing

B Pick whichever package appears first in the search results

4. Why do attackers choose names like 'nunpy' or 'reqeusts'?

A They make the malicious code run faster than the real package

B They look almost the same as popular names, so people install them by mistake

5. Which package name is most likely a typosquat of 'requests'?

A reqeusts

B requests

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1pip install reqeusts		Apip install acme-internal-tools
2npm view express maintainers downloads		BA typosquatting trap: the name is a misspelt version of the trusted package requests, so it could install malware by mistake
3A misspelt package name is a typosquatting risk because it looks almost the same as a trusted one		CChecks who publishes a package and how popular it is before installing, to spot a fake lookalike
4Dependency confusion: a public package uses the same name as a private internal one so the build installs the wrong one		DThe name is misspelt (lodsah instead of lodash) and was not checked, so a typosquatted malicious package could be installed.
5npm install lodsah # copied from memory, no check		Epip install colourama
6Installed it because it had 12 downloads and an unknown publisher		FThe student ignored warning signs: a very low download count and an unknown publisher suggest a fake lookalike package.

Definitions

typosquatting

Fill in the Blanks

Complete each line of code by filling in the missing parts.

# Trusted library for making web requests pip install ________

# View the author before you trust it pip ____ requests

trusted ← "requests" IF package _ trusted THEN PRINT "Possible typosquat"

IF downloads _ 100 THEN PRINT "Low downloads, be careful" ENDIF

IF name IN ownPackages THEN get from _______ registry ENDIF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A pip install reqeusts

B pip show requests

C pip list

Question 2

A npm install crossenv

B npm view cross-env

C npm audit

Question 3

A trusted = 'requests'

B name = 'reqeusts'

C if name == trusted:

D print('Typosquat?')

Question 4

A downloads = 52000000

B publisher = 'psf'

C if downloads > 100:

D print('Suspicious')

Question 5

A trusted = ['numpy', 'pandas']

B pkg = 'numpyy'

C print('Checking', pkg)

D if pkg not in trusted

E print('Do not install')

Answer Key

Typosquatting and malicious packages

Section A: Quick Questions

B — Publishing a malicious package called reqeusts to catch people trying to install requests

A — They might install a malicious look-alike package instead of the real requests package

A — Check the publisher and the download count before installing

B — They look almost the same as popular names, so people install them by mistake

A — reqeusts

Section B: Match the Pairs

pip install reqeusts → A typosquatting trap: the name is a misspelt version of the trusted package requests, so it could install malware by mistake

npm view express maintainers downloads → Checks who publishes a package and how popular it is before installing, to spot a fake lookalike

A misspelt package name is a typosquatting risk because it looks almost the same as a trusted one → pip install colourama

Dependency confusion: a public package uses the same name as a private internal one so the build installs the wrong one → pip install acme-internal-tools

npm install lodsah # copied from memory, no check → The name is misspelt (lodsah instead of lodash) and was not checked, so a typosquatted malicious package could be installed.

Installed it because it had 12 downloads and an unknown publisher → The student ignored warning signs: a very low download count and an unknown publisher suggest a fake lookalike package.

Section C: Definitions

typosquatting — Publishing a malicious package or site with a name almost the same as a trusted one (like reqeusts for requests), hoping people install or visit it by mistake.

Section D: Fill in the Blanks

# Trusted library for making web requests
pip install requests

# View the author before you trust it
pip show requests

trusted ← "requests"
IF package ≠ trusted THEN
  PRINT "Possible typosquat"

IF downloads < 100 THEN
  PRINT "Low downloads, be careful"
ENDIF

IF name IN ownPackages THEN
  get from private registry
ENDIF

Section E: Spot the Error

A — The package name is misspelt as 'reqeusts'. That is a typosquatting trap, because an attacker may have published a malicious package with that name. It should be 'pip install requests'.

A — 'crossenv' drops the hyphen from the real package 'cross-env'. Typosquatters use look-alike names like this. The correct line is 'npm install cross-env'.

C — The comparison is reversed. The warning should show when the name does NOT match the trusted name, so it should use !=.

C — A very low download count is a warning sign of a fake package. The check should use < so it flags packages with few downloads, not popular ones.

D — The if statement is missing its colon at the end. It should be 'if pkg not in trusted:' so the name 'numpyy' is flagged as not trusted.