For example, the developer requests the “electron” package but unintentionally spells it “electorn”. Typosquatting packages prey on a developer or unsuspecting user to make a minor typographical error which will trick them into installing the malicious package within their environment instead of the one they had originally intended to download. The two packages representing next-generation software supply chain attacks rely on typosquatting - an attack that impersonates legitimate packages and makes them available for unsuspecting developers to download. Following alerts from the Sonatype bots, our security research team verified the presence of malicious code in two npm packages and traced the intended exploit path. By applying machine learning and artificial intelligence to identify suspicious code commits, update signals, and developer patterns, the bots are continuously assessing changes across millions of open source software component releases. Sonatype’s discovery was initially made by its malicious code detection bots. Sonatype researchers discovered and confirmed the presence of two new vulnerable npm packages.

Sonatype download