One-Third of npm Typo Package Names Are Confirmed Malicious, Study Finds

·1 views

A live audit of typosquatting exposure across npm and PyPI checked every single-character variation — omissions, duplications, and adjacent transpositions — of the 30 most popular packages on each registry. On npm, 297 of 498 typo-variant names are currently registered, and 97 of those carry confirmed malicious advisories in OSV's public database. PyPI showed far lower risk, with only 47 of 582 candidate names registered and none flagged as malicious. The npm package 'request', though deprecated since 2020, topped the list with 17 confirmed-malicious typo variants, reflecting the lingering danger of widely depended-upon legacy packages. The findings, based on live API queries conducted on 25 August 2026, highlight a significant and documented supply-chain threat in the npm ecosystem.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

ShortSingh Skips Meme Monday in Observance of US Labor Day

DEV Community announced a pause on its regular Meme Monday feature this week. The break was taken in observance of Labor Day, a public holiday in the United States. Labor Day is celebrated annually on the first Monday of September. The community acknowledged the holiday with a brief, lighthearted note rather than its usual meme content.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Releases 11 Free Browser-Based Tools to Help Homelab Operators Plan and Debug

A developer has published a suite of eleven free tools at peira.dev/tools designed to answer practical questions that homelab setup guides typically leave unanswered, such as hardware sizing, backup validity, and failure recovery. The tools include a sizing calculator, node failure simulator, 3-2-1 backup planner, overlay network diagnostic, and a power-loss shutdown sequencer, among others. Seven of the eleven tools function fully offline once loaded, and four optionally integrate with a user-supplied AI language model for log triage, Compose file review, command explanation, and troubleshooting. Users can describe their lab once through a shared profile, which is stored only in the browser with no account, server, or external sync involved. A Markdown export feature allows the profile to be transferred across devices manually.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Three Common PHP-FPM Failures and How to Diagnose Them Without Guesswork

Most PHP-FPM outages on production servers trace back to three root causes: OOM kills from oversized worker pools, gradual OPcache exhaustion, and misconfigured per-worker memory assumptions. When the OOM killer terminates a PHP-FPM worker mid-request, the application log stays silent and Nginx records a connection reset error, making the cause easy to miss. OPcache degradation is subtler — response times climb slowly through the day as cache fills and script recompilation increases, then reset overnight when PHP-FPM restarts. A key diagnostic pitfall is checking OPcache status from the CLI, which reads a separate cache instance and reveals nothing about the live FPM pool. Distinguishing a configuration problem from a genuine capacity problem determines whether the fix is a config tweak or a more expensive infrastructure upgrade.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Three-Gate Method Helps Developers Decide When to Use Local vs Remote AI Models

A workflow published on DEV Community proposes that developers measure three key factors before sending any AI prompt to a remote model: network reachability, presence of sensitive data in the text, and a stopwatch comparison of local versus remote processing time. The approach argues that guessing which option is faster wastes battery and compute resources, and that instinct should be replaced with simple, repeatable measurement. Secret credentials embedded in prompts are treated as a hard stop, meaning no remote call should proceed until the text is clean regardless of cost or speed. A sample Python script, intended as a labeled example rather than a finished product, demonstrates how to check connectivity, scan for secret residue, and time a stub completion locally. The article was prepared as part of outreach for MonkeyCode, which offers free model access, though the workflow is described as valid independent of any specific vendor or service.

0 comments Read more at DEV Community