Check a package name before an install executes its code
Compare the exact registry name with the project’s official instructions, then inspect metadata and lifecycle scripts before installing.
In brief
Typosquatting relies on a mistaken package name or a convincing lookalike. Installing can execute lifecycle scripts, so reading a package’s metadata first is safer than installing it just to inspect it.
The exact name, including scope and punctuation, matters more than a familiar-looking description.
Match the full identity
Check scope, hyphens and spelling against the official repository’s installation instructions. Search placement or an advert is not an authoritative install command. Look for a matching repository link and maintainer history, while recognizing that metadata can itself be misleading.
Inspect before execution
For an npm package, npm view with the exact name can retrieve metadata without installing its code. Examine dependencies and declared scripts where shown, and review the package contents through a safe inspection workflow. Do not test an unfamiliar package on a machine holding production secrets.
Keep the change reviewable
Inspect newly added dependencies and lockfile resolution, not just the top-level name. If an unexpected script or package appears, stop and investigate. Record why the dependency is needed; avoiding an unnecessary package removes a trust decision entirely.
Before you act
Popularity, a lockfile and a successful vulnerability audit cannot establish that the intended publisher created the package. Even a legitimate dependency can later change ownership or behaviour.
What to do next
- Copy the exact package name from the official project documentation.
- Inspect the registry package, repository and scripts without running an install.
- Review the lockfile change and install in an appropriately isolated development environment.
