Typosquatting on Github? (@react-aria/toast vs react-aria/toast)

[NickWoodward]

*created a github issue too, just incase this doesn't get seen

Not sure if this is actually an attack, but it feels like it - If you try and install the package npm i react-aria/toast it asks you for your github login credentials.

[reidbarber]

Reposting from #6697

react-aria/toast is not a valid NPM package name (scoped packages would require the @ prefix in order to use a /), so I don't think there is anything malicious here. The NPM CLI is likely just trying to authenticate with Github to check for any private packages available.

[NickWoodward]

Ah ok, good to know, just thought I'd report it in case :)

[reidbarber]

Thanks!