Security findings

Typosquatting

Publishing a package under a name one typo away from a popular one, to catch people who mistype it.

Registries let anybody publish any free name, so a name that differs from a well-known package by one character, a swapped pair of letters or a missing scope is often available. Someone who types it by mistake installs the other publisher's code, which may do what the real package does and something else besides.

Near-miss names are also chosen without malice, which is why a name collision is a question to ask rather than a verdict. This site's publisher checks flag names a couple of edits from another listing's, so a person can look.

Why it matters

Installing an MCP server is running code with your privileges. A typo in the name is enough to run somebody else's.

The mistake everyone makes

Checking the name by eye. The whole technique depends on names that look right.

Related terms

Supply chain attack

Compromising something you already trust rather than attacking you directly.

Pinned version

Installing one exact published release rather than whatever is current.

Lifecycle script

A command a package tells the package manager to run automatically, for example straight after it is installed.

Verification

The published set of tests a listing is put through, and the record of what they found.

See Typosquatting on a real listing

Every term here shows up in the catalogue next to a real result, with the findings published and the limits stated. Free to browse, no account needed.

Open the catalogue