This article provides insights into a quite interesting type of typosquatting attack on NPM. Capitalization! Someone could upload a package with the name of a popular package, but with all lowercase letters. Since npm’s 2017 package name rules, new names must be lowercase and may not differ from existing ones only by punctuation, but existing mixed-case packages stayed and their lowercase twins were never blocked. That post even cites JSONStream and jsonstream as an example of accidental typosquatting, so the gap was hardly a secret. To compare with other package managers, PyPI and NuGet will restrict anyone else from uploading a package with the same name, regardless of the capitalization of letters. The NPM security team promptly acknowledged and effectively addressed the security issue. Now newly uploaded packages in conflict will receive an error message “Package name too similar to existing package”.
