Typosquatting on react-aria/toast?

[NickWoodward]

Provide a general summary of the issue here

Thought I'd just report some strange behaviour I came across when trying to install the correct package @react-aria/toast.

The typo react-aria/toast via npm prompts for your github credentials - which feels suspicious at best.

🤔 Expected Behavior?

I should be able to read and spell

😯 Current Behavior

I can't, so typed the wrong package name

💁 Possible Solution

No response

🔦 Context

No response

🖥️ Steps to Reproduce

npm i react-aria/toast

Version

3.35.1

What browsers are you seeing the problem on?

Other

If other, please specify.

No response

What operating system are you using?

win 11

🧢 Your Company/Team

No response

🕷 Tracking Issue

No response

[reidbarber]

react-aria/toast is not a valid NPM package name (scoped packages would require the @ prefix in order to use a /), so I don't think there is anything malicious here. The NPM CLI is likely just trying to authenticate with Github to check for any private packages available.