A typosquat replacing the 'l' in jellyfish with a capital 'I' stole SSH and GPG keys from developers who mistyped the name.
Lived on PyPI for ~a year alongside python3-dateutil (typosquat of dateutil) before removal.
A package published under a name that mimics a popular one, hoping developers mistype or copy it.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database; a free CI gate that blocks risky dependencies before they merge is coming soon.