3 ms·

There was a thesis on this a year ago: http://incolumitas.com/2016/06/08/typosquatting-package-managers/ http://incolumitas.com/2016/06/08/typosquatting-packag

There was a thesis on this a year ago: http://incolumitas.com/2016/06/08/typosquatting-package-managers/ http://incolumitas.com/2016/06/08/typosquatting-package-mana... After the "left pad" debacle, npm provided protection from typosquatting a deleted module: http://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm http://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm

tyingq 9y ago
Don't know that this npm module has bad intentions, but I'll bet some of the downloads were unintentional. https://www.npmjs.com/package/loadash https://www.npmjs.com/package/loadash 245 downloads in the last day.
- micaksica 9y ago
  I pulled down this package. It is just a package.json file.
  - tyingq 9y ago
    Sure, but the number of downloads/day shows the potential of squatting on a typo.