Open-Source Software Supply Chain: Verify Package Names Before Installing

The Risk

When installing open-source tools from package managers (pip, npm, GitHub releases), verify the spelling of the package name carefully. Attackers regularly upload malicious packages with names that are slight misspellings of popular tools — a technique called typosquatting.

How This Applies to Controls Engineers

We routinely install Python libraries for PLC communication (pycomm3, pymodbus), data analysis, or custom scripting tools from GitHub. A single typo in a pip install command can pull down a package that contains malware — keyloggers, credential stealers, or backdoors.

Examples of What Can Go Wrong

• pip install pymodbuss instead of pip install pymodbus — the extra “s” could be a malicious package.
• Cloning a GitHub repo with a similar name to the legitimate project — same code with added malware.
• Downloading a release binary from a forked repo instead of the official one.

Verification Steps

1. Double-check the package name against the official documentation or project page before running install commands.
2. Verify the publisher — on PyPI, check the maintainer. On GitHub, check the organization and star count.
3. Check download counts — a legitimate popular package will have thousands or millions of downloads. A typosquat will have very few.
4. Review the source code briefly — especially for lesser-known packages. Look at the setup.py or __init__.py for any suspicious imports or network calls.

For Engineering Laptops

Engineering laptops that connect to PLC networks are high-value targets. A compromised laptop on an industrial network is a serious incident. Treat package installation with the same caution as any other software installation on production-adjacent machines.