Learn English vocabulary for package security: npm audit, CVEs, transitive dependency risk, SBOM, supply chain attacks, and typosquatting.
0 / 12 completed
1 / 12
Running 'npm audit' in a project does which of the following?
npm audit queries the npm security advisory database. It reports vulnerabilities in your dependency tree with severity ratings (low/moderate/high/critical) and often suggests version upgrades or patches to resolve them.
2 / 12
A 'transitive dependency' security risk means:
If your app uses framework X, which uses parser Y, which has a critical vulnerability — that is a transitive dependency risk. You never directly chose parser Y, but it is in your dependency tree. This is why audit tools scan the full tree, not just direct deps.
3 / 12
'Typosquatting' as a package supply chain attack refers to:
Developers mistype package names and accidentally install attacker-controlled packages. The malicious package (e.g., 'cross-env2' vs 'cross-env') may steal environment variables or execute arbitrary code during install via postinstall scripts.
4 / 12
An SBOM (Software Bill of Materials) for a software project is:
An SBOM is like an ingredient list for software. Formats like SPDX and CycloneDX document every library and its version. SBOMs are increasingly required by governments and enterprises to assess exposure when a new vulnerability (like Log4Shell) is disclosed.
5 / 12
A 'dependency confusion' supply chain attack (as demonstrated by Alex Birsan in 2021) exploits the fact that:
Many package managers check public registries first. If a company uses an internal package named 'company-utils', an attacker publishes 'company-utils' on npm with a higher version — the package manager installs the public attacker package instead of the private legitimate one.
6 / 12
Sarah (Senior Developer) comments on a PR:
"I'm seeing that `lodash` is still being used here. We've discussed migrating to `date-fns` to reduce our bundle size and improve security by avoiding outdated versions. Can you investigate updating it?"
The comment demonstrates an understanding of the importance of dependency management. Sarah's focus on outdated versions and bundle size aligns with security best practices concerning dependency vulnerabilities. The goal isn't just about formatting; it's a proactive step to mitigate risks.
7 / 12
Mark (Junior Dev) sends a message in the #dev-ops Slack channel:
"Just ran `npm audit` and it's full of warnings about `moment`. Should I just ignore them?"
'npm audit' identifies both errors and warnings, indicating potential vulnerabilities. Ignoring these warnings is risky because they often represent genuine security issues requiring attention. It's crucial to investigate and remediate flagged dependencies proactively.
8 / 12
David, the security engineer, just posted a comment on your PR:
"I noticed you've included `requests` in this project. While it's widely used, recent vulnerabilities have been discovered. Consider upgrading to `httpcore-js` to mitigate potential risks and ensure alignment with our security standards."
This scenario tests your understanding of proactive security recommendations. Simply ignoring the comment isn't sufficient – it highlights a specific vulnerability. The correct response involves investigation and careful consideration of upgrade impacts; blindly replacing dependencies without assessment can introduce new problems or break existing functionality.
The key is to demonstrate awareness and a structured approach to risk mitigation.
9 / 12
Ben sends the following message in Slack:
"Hey team, `npm audit` just flagged several critical vulnerabilities in our `passport` dependency. It's recommending upgrades, but I'm not sure how to proceed without breaking existing authentication flows."
This tests your ability to interpret `npm audit` output. 'Critical' vulnerabilities demand immediate attention, but blindly upgrading without understanding the implications is dangerous. The correct answer focuses on investigation and researching compatible upgrade paths – a crucial step before deploying any changes to production.
It's important to remember that upgrades aren't always straightforward and can introduce breaking changes.
10 / 12
Maria is writing the description for a PR that adds a new dependency:
"This PR introduces `axios` for making HTTP requests. We've chosen it over `superagent` because of its more modern API and improved security features, including automatic TLS negotiation. We'll ensure proper version pinning to prevent unexpected updates."
This scenario focuses on documenting dependencies with a focus on security. A good PR description should explain *why* a particular dependency was chosen, particularly highlighting relevant security features like automatic TLS negotiation. Simply stating that it's 'better' isn't sufficient; the goal is to communicate the reasoning and justify the decision.
Proper documentation aids in future maintenance and allows others to understand the security choices made.
11 / 12
John is reviewing a PR that uses a newly added `jsonwebtoken` dependency:
"I see you're using `jsonwebtoken`. Are you storing the secret key directly in your code? If so, that's a major security risk. You should be using environment variables to manage sensitive information."
This tests your understanding of secure coding practices regarding secrets management. Storing API keys directly in code is a common and extremely dangerous vulnerability. The correct response involves immediate action – removing the secret key and setting it as an environment variable. This demonstrates awareness of best practices and proactive security measures.
It's crucial to take feedback seriously, especially when addressing potential vulnerabilities.
12 / 12
Emily, a senior developer, sends the following message in a standup update:
"I've been focusing on improving our dependency security. I'm working with the team to implement SBOMs for all of our projects and regularly using `npm audit` to identify vulnerabilities. We're also investigating ways to improve our supply chain risk management."
This question assesses your understanding of a comprehensive approach to dependency security. The correct response highlights that Emily's strategy encompasses multiple layers – SBOMs (providing full visibility), regular audits (`npm audit`), and proactive supply chain risk management. This demonstrates an understanding beyond just patching immediate vulnerabilities.
A truly secure development process involves considering the entire lifecycle of a project's dependencies.
What will I practise in "Dependency Security Vocabulary"?
This module focuses on Package Management — real workplace phrasing you'll use on the job. It contains 12 scenario-based multiple-choice questions with instant feedback.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account or sign-up required.
How many questions does this exercise have?
This module includes 12 questions. Each one gives an immediate right/wrong result plus a full explanation of the correct phrasing.
What happens if I answer a question incorrectly?
You'll see the correct answer highlighted straight away, along with a plain-English explanation of why it's right and why the other options don't fit — mistakes are part of the learning here.
Can I retry the exercise if I want a better score?
Yes — use the 'Try again' button on the results screen to reset your score and go through the questions again. There's no limit on attempts.
Who is this Package Management exercise for?
It's aimed at IT professionals with working English who want to sound more natural and precise around package management — useful whether you're preparing for real conversations at work or just building confidence with the vocabulary.
Do I need an account to track my progress?
No account is needed. Your progress through the exercise is tracked locally in your browser for the current session, and you can replay the module at any time.
How is this different from reading a blog article?
This exercise is an interactive drill that tests and reinforces specific phrasing through multiple-choice questions with instant feedback, while blog articles explain concepts and vocabulary in prose. The two work well together.
Where can I find more Package Management exercises?
See the Package Management hub for more modules like this one, or browse the full Exercises page for other IT-English topics.
Can I complete this exercise on my phone?
Yes — every exercise on CoderSlingo is fully responsive and works on phones and tablets, so you can practise anywhere.