Yeah, there have been multiple typo-squatting incidents.

http://blog.npmjs.org/post/163723642530/crossenv-malware-on-...