A typosquat replacing the 'l' in jellyfish with a capital 'I' stole SSH and GPG keys from developers who mistyped the name.
Lived on PyPI for ~a year alongside python3-dateutil (typosquat of dateutil) before removal.
A package published under a name that mimics a popular one, hoping developers mistype or copy it.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database, or add the free CI gate to block risky dependencies before they merge.