Typosquatting is one of the best-documented supply-chain attack techniques — publish a package one keystroke away from something popular, wait for developers to fat-finger npm install , and you have a foothold on their machine or CI pipeline with no CVE ever filed. It's been written about for years. What's less documented is a very simple question: right now, today, how many of those look-alike names are actually sitting on the registry? So we checked. Not a sample, not an estimate — every...