How npm Typosquatting and Dependency Confusion Attacks Silently Compromise Dev Systems

In February 2021, security researcher Alex Birsan demonstrated how malicious packages could be pushed to the internal build systems of Apple, Microsoft, PayPal, and dozens of other firms by exploiting package manager resolution logic — a technique known as dependency confusion. Separately, typosquatting attacks target developers who mistype package names, with historically documented cases on npm including fake versions of lodash and cross-env that stole credentials and environment variables. Both attack types rely on npm's automatic execution of postinstall scripts, which can exfiltrate data or install backdoors before a developer reviews the code. Because neither method involves a known software flaw, they carry no CVE and are invisible to conventional vulnerability scanners. Defences include scoping internal packages under private namespaces, auditing install scripts from unknown publishers, and using edit-distance algorithms to flag package names suspiciously similar to popular libraries.