Encyclopedia
npm⚠ HIGHtyposquat⚠ ACTIVE THREAT

crossenv

First seen: Sep 25, 2026 0 viewsMimics: cross-env
Share threatHN
Threat Description

A typosquat of the legitimate cross-env package, part of the August 2017 npm typosquat campaign documented by the npm team. The package used a postinstall script to collect environment data from the developer's machine and exfiltrate it, amassing around 679 downloads before removal.

AI Hallucination Analysis
Unlikely AI Hallucination0%
Known to be hallucinated by: None - this is a real typosquat, not an AI hallucination.
Remediation Guide
  1. Remove crossenv and install the legitimate cross-env. 2. Rotate any npm tokens present in the environment during exposure. 3. Audit package.json for typosquatted names. 4. Enable npm 2FA and pin dependencies with hash verification.
View on registry
Quick Facts
Ecosystem
npm
Risk Level
HIGH
Type
typosquat
Status
ACTIVE
Legitimate Package
cross-env
Hallucination Confidence
0%
Check My Project
Scan for this package