Beyond typos: threat actors using naming-variants to steal developer data

Open source package attacks have evolved beyond typosquatting, and defenses are struggling to keep up. Attackers now create package names that seem legitimate, using real ecosystem structures and vocabulary to appear plausible rather than relying on mistyped keystrokes.

This research analyzes 4,309 malicious packages, showing naming-variant attacks as the dominant threat. Key findings:

• 91% of brandjacking malware used naming-variant tactics over typosquats
• Suffix addition was the top attack subtype, tied to secrets exfiltration and dropper incidents
• React, ESLint, and Tailwind ecosystems were heavily targeted due to plugin-heavy naming

Read the full research to learn how defenders must adapt.