Typosquat

Names close enough to be mistaken

Edit distance across every package name the graph holds. One transposed character in an install command is the whole attack, so proximity plus a shared prefix is the signal worth acting on.