Learn the vocabulary of malicious packages published under misspelled names of popular dependencies.
0 / 5 completed
1 / 5
At standup, a dev mentions attackers publishing a malicious package under a name that is a common misspelling of a popular package, hoping a developer will typo the install command and pull in the malicious code instead. What is this attack called?
Typosquatting is exactly this: attackers publish a malicious package under a name that is a common misspelling or lookalike of a popular package's name, hoping a developer will typo an install command and pull in the malicious package instead of the legitimate one. A hash collision is an unrelated hash-table concept about two keys sharing a bucket. This mimic-a-popular-name approach is exactly why typosquatting is a persistent supply-chain risk in public package registries.
2 / 5
During a design review, the team adds automated dependency-name verification against a known-package allowlist to its build pipeline, specifically because catching a misspelled package name before installation avoids a typosquatted package ever reaching production. Which capability does this provide?
Automated dependency-name verification here provides early detection of typosquatted dependencies before they're installed, since comparing every dependency name against a known-package allowlist catches a misspelled, lookalike name before it can pull in malicious code. A build pipeline with no dependency-name verification at all installs whatever name is listed, typo and all, without any check. This catch-the-misspelling-before-install behavior is exactly why dependency-name verification is a standard supply-chain defense.
3 / 5
In a code review, a dev notices a build pipeline installs every dependency name listed in a manifest with no verification against a known-package allowlist, letting a single typo silently pull in whatever package happens to exist under that misspelled name. What does this represent?
This is a missed opportunity to catch typosquatting, since verifying dependency names against a known-package allowlist would catch a misspelled, lookalike name before it silently pulls in malicious code. A cache eviction policy is an unrelated concept about discarded cache entries. This no-verification pattern is exactly the kind of supply-chain gap a reviewer flags once a single typo could pull in an unverified package.
4 / 5
An incident report shows a production build silently included a malicious package, because a manifest had a single misspelled dependency name and the build pipeline installed it with no verification against a known-package allowlist. What practice would prevent this?
Adding dependency-name verification against a known-package allowlist flags and blocks a typosquatted name before installation. Continuing to install every dependency name listed in the manifest with no verification regardless of how easily a single typo could pull in a malicious package is exactly what caused the issue described in this incident. This allowlist-verification approach is the standard fix once a manifest is confirmed capable of silently installing an unverified package.
5 / 5
During a PR review, a teammate asks why the team adds automated allowlist verification against typosquatting instead of simply asking every developer to type dependency names carefully. What is the reasoning?
Automated allowlist verification catches a misspelled name reliably every time regardless of human attention, while asking developers to type carefully depends entirely on individual vigilance and will eventually miss a typo, especially under time pressure or when copy-pasting from an untrusted source. This is exactly why automated verification is the standard defense against typosquatting, while careful typing alone is never considered sufficient.
What does the "Typosquatting Vocabulary" vocabulary exercise cover?
This exercise tests real IT vocabulary related to typosquatting vocabulary through 5 multiple-choice questions, each built from realistic workplace sentences rather than abstract definitions.
Is this vocabulary exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is completely free — no account, sign-up, or payment required.
How many questions does this exercise have?
This exercise has 5 questions. Each one shows a real-world sentence or scenario with multiple-choice options and an explanation once you answer.
What happens after I answer a question?
You'll see immediate feedback showing whether your answer was correct, along with a short explanation of why — then a button to move to the next question, and a full results screen at the end.
Can I retry the exercise if I get questions wrong?
Yes. Once you reach the results screen, click "Try again" to reset your answers and go through the exercise from the start as many times as you like.
Do I need to create an account to take this exercise?
No account is needed. Your answers are scored in your browser during the session — nothing is saved to a server, so you can jump straight in.
Is my progress saved if I leave the page?
No — progress within an exercise resets if you navigate away or reload. Each exercise is short enough to complete in a few minutes in one sitting.
Are these vocabulary exercises connected to other topics?
Yes — browse the full vocabulary exercises hub to find related modules covering adjacent IT topics and roles.
How is this different from reading a glossary or blog article?
Exercises like this one are active recall drills — you have to choose the correct term or phrasing yourself, which builds retention faster than passively reading a definition.
Where can I find more vocabulary exercises?
Browse the full Vocabulary exercises hub for hundreds of modules covering Agile, DevOps, security, databases, architecture, and more — organised by IT role and skill.