NuGet Typosquatting

It occurs when the attacker creates a package with a group or name similar to a popular, inducing users to install this package inadvertently. This attack strategy is generic and often used with different build managers, including NuGet.

If the project has the malicious dependency then the code written by the attacker could be executed.

Even the package may contain the same functionality as the original and thus go unnoticed and end up running in a production environment.

The Newtansoft.Json package does not exist. The popular package is Newtonsoft.Json.

Choose the right dependency and be careful when adding new ones.

This tool proposes a popular package to replace the malicious one when it finds such misconfiguration.