An evil-twin campaign is a supply-chain attack pattern in which an attacker publishes a lookalike package, extension, or tool that closely imitates a legitimate one. The clone may copy the name, icon, description, or namespace of a trusted project so that users, developers, or automated installers mistake it for the real software. Even when the malicious package is not identical, the naming overlap can be enough to trigger installation or trust.
This tactic matters because software marketplaces and package registries often use identity signals as part of their security model. In practice, defenders look for typosquatting, namespace abuse, publisher impersonation, and suspicious version histories. Evil-twin campaigns can bypass casual review, poison developer environments, and reach CI pipelines or onboarding scripts. Defenses include verifying publisher provenance, pinning hashes, checking installation sources, and preserving historical metadata so a package’s past abuse is not lost when registry labels change.