`crossenv` (malicious) vs. `cross-env` (legitimate) -- The malicious npm package stole environment variables - `python3-dateutil` (malicious) vs. `python-dateutil` (legitimate) -- Contained cryptocurrency mining code - `jeIlyfish` (malicious, with uppercase I) vs. `jellyfish` (legitimate) -- Stole S