A typosquat of the popular colorama package hijacked the Windows clipboard to swap in the attacker's cryptocurrency wallet address.
Early, widely-cited example of typosquatting for crypto theft on PyPI.
A package published under a name that mimics a popular one, hoping developers mistype or copy it.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database, or add the free CI gate to block risky dependencies before they merge.