Scam patterns
Poisoned software dependencies
A familiar or mistyped package adds key theft or transaction manipulation to a build.
Research articles and reference entries are published in English. Navigation is available in seven languages.
People & projects
In this article
Overview
A familiar or mistyped package adds key theft or transaction manipulation to a build.
Why it matters
Users are reached through a developer's supply chain.
What to check
Pin versions, inspect lockfile changes and preserve package hashes and provenance.