Spot the typosquat: eight package names, which one is fake?

Typosquatting works for one reason: nobody reads a dependency name twice. You copy a command from a Stack Overflow answer, you fix what looks like a typo, you run it. If the name you ran was the impostor, its install script already ran, and install scripts run before a single line of your own code does. You do not have to import the package. You only have to install it.

So here is the drill. Eight install lines, each listing four package names. In each line, exactly one name is a squat of a real, widely used package. Pick it before you scroll. No tool needed for this one: it is pure pattern recognition, which is the skill that actually protects you at the terminal.

The eight

1.  npm install        lodash  lodahs  express  chalk
2.  pip install        requests  urllib3  urlib3  certifi
3.  pip install        python-dateutil  python3-dateutil  pytz  six
4.  npm install        cross-env  crossenv  rimraf  nodemon
5.  pip install        colorama  colourama  termcolor  rich
6.  npm install        body-parser  bodyparser  cookie-parser  morgan
7.  pip install        beautifulsoup4  beautifulsoup5  lxml  html5lib
8.  npm install        jellyfish  jeIlyfish  Levenshtein  rapidfuzz

Write down your eight picks. Then read on.

Answers

1. lodahs — lodash with the last two letters transposed. A transposition is the error your own fingers make, which is what makes it the most productive squat there is.
2. urlib3 — urllib3 with one l dropped. A single missing letter in a name you have typed a hundred times is almost invisible.
3. python3-dateutil — the real package is python-dateutil. Adding the 3 looks like a reasonable "Python 3" version and is not.
4. crossenv — the real one is hyphenated, cross-env. Dropping the hyphen is a classic, because people remember the sound of a name, not its punctuation.
5. colourama — the British spelling of colorama. Spelling-variant squats catch a whole region of typists at once.
6. bodyparser — the real one is body-parser. Same hyphen trick as line 4.
7. beautifulsoup5 — there is no version 5; the package is beautifulsoup4. Bumping a version number you half-remember is a convincing mistake.
8. jeIlyfish — this is the famous one. That is a capital I standing in for the lowercase l in jellyfish. In most fonts they are the same shape. A package by that name sat on PyPI for nearly a year lifting data before anyone noticed.

What the score means

Eight out of eight: you already read dependency names the way a proofreader reads a page, and line 8 did not fool you. Five to seven: good instincts, and the misses are usually the homoglyph on line 8 or the version-number squats, which are the two hardest. Four or fewer: you were skimming, which is the normal human default and precisely the behaviour the attack is built on.

The habit worth keeping is small and specific. When you install something, read the name character by character once, especially an l, an I, a 1, a 0 and an O, and especially a hyphen. Prefer copying the name from the project's own documentation over retyping it. And remember that the danger is not using the package, it is installing it, so a name you install "just to check" has already done whatever it was going to do.

Your dependencies run code before your code does goes into the install-script mechanism in full, and checking an npm package before you install it covers the thirty seconds of checks that catch most of these. The Daily Adversary serves a fresh squat in its rotation.