Typosquatting

In February 2021 researcher Alex Birsan published packages on npm, PyPI and RubyGems named after internal libraries at Apple, Microsoft, PayPal and Tesla. Their dependency managers installed them in place of the in-house ones. The technique, a cousin of typosquatting, earned him more than $130,000 in bounties. Typosquatting, or URL hijacking, means registering slightly altered versions of a well-known domain name to catch stray traffic or pass for the legitimate site. The variants play on nearby typos on a QWERTY keyboard and on a hyphen dropped or added. Then there are homoglyphs, characters that look alike, such as the digit zero in place of the letter o. Combo-squatting tacks a generic word onto the legitimate domain: bank-secure, paypal-login. Typosquatting started in the 1990s as an opportunistic commercial practice that scooped up careless visitors, and it turned into an organized attack vector as targeted phishing spread. In software supply chain attacks, the variant is called package typosquatting, also dependency confusion or package squatting. The attacker puts packages on public registries such as PyPI or npm under names that mimic a company's internal library, counting on the dependency manager to download them in place of the legitimate version. Birsan demonstrated this variant at scale in 2021, reaching systems at Apple, Microsoft and PayPal. For insurers, typosquatting feeds wire fraud, targeted phishing and software supply chain compromise, and the resulting losses can be hard to tie to a specific policy.