Typosquatting vs. Copycat Packages: Understanding the Differences

While copycat packages and typosquatting are related concepts, they are not exactly the same. Both involve deceptive tactics to trick users into downloading malicious software, but they do so in slightly different ways. Here’s a detailed explanation of each:

Typosquatting

Typosquatting involves registering domain names or package names that are very similar to legitimate ones, often differing by just a typographical error. The goal is to deceive users who make mistakes when typing a URL or a package name, leading them to malicious sites or software instead of the intended legitimate ones.

Example:

• Legitimate package: express.

• Typosquatted package variants: expres (missing an ‘s’), expresss(extra ‘s’), or expreess (double ‘e’).

Real-World Case:

In November 2018, a malicious JavaScript package called flatmap-stream was identified and removed from the NPM ecosystem. The nefarious modification was introduced into this package, which was then added as a direct dependency to the popular event-stream package. This malicious version of flatmap-stream was downloaded nearly 8 million times. Developers unknowingly using the compromised event-stream package were inadvertently exposed to the malicious code1.

Here, the focus is on slight misspellings or variations that exploit common typing errors.

Copycat Packages

Copycat packages involve creating malicious packages that imitate popular and legitimate ones. This imitation can go beyond slight misspellings and may include similar names, descriptions, documentation, and functionality to make the malicious package appear legitimate and trustworthy.

Example:

• Legitimate package: lodash

• Copycat package variants: lodashjs, lodash-tools, or even a package with the same name but uploaded by a different author in a less secure repository

Real-World Case:

Consider the popular open-source PHP-based Laravel application called laravel-realworld-example-app. This application contains real-world examples (CRUD operations, authentication, advanced patterns, etc.) of the RealWorld API spec. While the legitimate package serves as a reference, a copycat package could imitate it using a similar name (e.g., laravel-realworld-example-apps or laravel-realworld-examples). Such copycat packages might include similar functionality, descriptions, and even documentation, tricking developers into using them instead of the authentic version

The focus here is on a broader imitation that includes not just names but also aspects of the legitimate package’s presentation and functionality.

Key Differences

Focus:

• Typosquatting primarily targets typographical errors made by users.

• Copycat packages aim to mimic legitimate packages more broadly, potentially including similar names, descriptions, and functionality.

Scope of Imitation:

• Typosquatting typically involves minor changes in the package name.

• Copycat packages may involve a more comprehensive imitation, making them appear even more convincing.

Overlap

There is an overlap between the two concepts, as typosquatted packages can be considered a subset of copycat packages. Both tactics aim to deceive users into installing malicious software, but typosquatting exploits common typing mistakes, while copycat packages may use a broader range of imitation strategies.