search

adobe / react-spectrum

A collection of libraries and tools that help you build adaptive, accessible, and robust user experiences.
https://react-spectrum.adobe.com
Apache License 2.0
12.53k stars 1.08k forks source link

Typosquatting on react-aria/toast? #6697

Closed NickWoodward closed 1 month ago

NickWoodward commented 1 month ago

Provide a general summary of the issue here

Thought I'd just report some strange behaviour I came across when trying to install the correct package @react-aria/toast.

The typo react-aria/toast via npm prompts for your github credentials - which feels suspicious at best.

🤔 Expected Behavior?

I should be able to read and spell

😯 Current Behavior

I can't, so typed the wrong package name

💁 Possible Solution

No response

🔦 Context

No response

🖥️ Steps to Reproduce

npm i react-aria/toast

Version

3.35.1

What browsers are you seeing the problem on?

Other

If other, please specify.

No response

What operating system are you using?

win 11

🧢 Your Company/Team

No response

🕷 Tracking Issue

No response

reidbarber commented 1 month ago

react-aria/toast is not a valid NPM package name (scoped packages would require the @ prefix in order to use a /), so I don't think there is anything malicious here. The NPM CLI is likely just trying to authenticate with Github to check for any private packages available.