Another wave of typosquat packages hit a major registry, and the fix everyone proposes still won't ship

A batch of typosquatted packages got pulled from a major registry this week after a researcher caught them exfiltrating environment variables on install. Names one or two characters off from popular libraries, publish timestamps clustered together, obviously automated. Standard stuff, as these things go now.

What’s not standard, what’s never standard, is any actual structural fix showing up afterward. Every time this happens there’s a wave of “we need mandatory namespace verification” and “publishers should require 2FA” and every one of those things is correct and every one of those things has been correct for about eight years without becoming policy.

Why the obvious fixes don’t ship

Not because the registries don’t care — I’ll extend that much good faith. It’s because every fix that would actually move the needle also adds friction to the exact workflow that made these ecosystems grow in the first place: publish, no gatekeeper, no review queue, instant global availability. That frictionlessness is the feature. The typosquats are the tax on the feature. Nobody running the registry wants to be the one who traded growth-rate for safety, so the tax gets paid in someone else’s incident report instead.

I’m not saying frictionless publishing was wrong. It’s the reason these ecosystems have the library coverage they do. I’m saying pretending the tradeoff doesn’t exist, cycle after cycle, is how you end up relearning the same lesson every few months with a different package name in the postmortem.

What actually protects you, since the registry isn’t going to

• Pin exact versions and hashes in lockfiles, and treat an unreviewed lockfile diff as a code review item, not a rubber stamp.
• Run install scripts in a sandbox or disable them outright where your build allows it — most of these attacks fire on postinstall.
• Mirror or vendor anything load-bearing. If a typosquat gets published under a name close to a dependency you pull fifty times a day in CI, you want your CI pulling from a cache you control, not resolving live against the public registry every run.

None of this is exotic advice. It’s the same discipline people applied to apt sources and RPM repos back when “supply chain” wasn’t a term anyone used because it was just called “not trusting random servers on the internet by default.” We reinvented the problem. We can reinvent the caution too.