Defences: review every new dependency name, install from a reviewed lockfile instead of typing names by hand, and prefer well-known packages.
typosquatting
Publishing a malicious package whose name is a near-miss of a popular one, hoping for a typo.
Defences: review every new dependency name, install from a reviewed lockfile instead of typing names by hand, and prefer well-known packages.