Typosquatting

A technique of publishing a package or domain whose name closely mimics a popular target (for example "lodahs" instead of "lodash") to trap developers who make a typo. In the npm, PyPI, or Composer ecosystems, a typosquatted package can inject malicious code straight into the build chain. It is a widespread variant of software supply chain attacks.