A recurring campaign publishes typosquats of popular web3 and crypto libraries that exfiltrate wallet seed phrases and environment secrets on install.
Illustrates the ongoing, automated nature of typosquat campaigns against high-value ecosystems.
A package published under a name that mimics a popular one, hoping developers mistype or copy it.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database; a free CI gate that blocks risky dependencies before they merge is coming soon.