I Scanned 500 npm Packages for Typosquatting — 23 Were Suspicious

Last month, a developer on my team installed colurs\ instead of colors\ . One letter difference. The package existed, had 200+ weekly downloads, and contained code that silently posted environment variables to a remote server. That incident made me wonder: how many of the 2+ million npm packages are typosquatting popular ones? The Experiment I wrote a script that: Took the top 500 most-downloaded npm packages Generated common typos (character swaps, missing letters, doubled letters, common misspellings) Checked if those typo-names existed as real packages Analyzed what those packages actually did The Results Out of ~4,500 typo variations I generated, 347 existed as real packages . Most were legitimate (abandoned, joke packages, or unrelated). But 23 raised red flags: 8 had install scripts that made network requests 6 had obfuscated code in their postinstall\ hooks 5 had suspiciously recent publishes (within 2 weeks) with names close to trending packages 4 had dependency chains that pul