Web Security · Senior · Question 56 of 75

What is typosquatting in package registries?

1Publishing packages with typos in the README
2Squatting on a domain name similar to a company's
✓Correct answer: Publishing malicious packages with names close to popular ones, like reactt or lodahs

Explanation

A single typo in npm install can run attacker code. Review new dependencies and their names before adding them.

Further reading

OWASP: NPM Security Cheat Sheet ↗

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.