docs: fix typo on "Threats and Mitigations" page (#409)
This: > If you believe you have identified **a** dependency confusion **packages**... Should read: > If you believe you have identified a dependency confusion **package**...
Eric Mutta committed
Jan 12, 2023 at 03:29 UTC
90b72462d347e5cd90be28190affe686f7109519
1 file changed
+1
-1
content/threats-and-mitigations/index.mdx
+1
-1
@@ -29,7 +29,7 @@ npm does periodically check if accounts email addresses have expired domains or
29
30
Attackers may attempt to trick others into installing a malicious package by registering a package with a similar name to a popular package, in hopes that people will mistype or otherwise confuse the two. npm is able to detect typosquat attacks and block the publishing of these packages.
31
32
-A variant of this attack is when a public package is registered with the same name of a private package that an organization is using. We strongly encourage using [scoped packages](https://github.blog/2021-02-12-avoiding-npm-substitution-attacks/) to ensure that a private package isn’t being substituted with one from the public registry. While npm is not able to detect dependency confusion attacks we have a zero tolerance for malicious packages on the registry. If you believe you have identified a dependency confusion packages, [please let us know][report-malware]!
32
+A variant of this attack is when a public package is registered with the same name of a private package that an organization is using. We strongly encourage using [scoped packages](https://github.blog/2021-02-12-avoiding-npm-substitution-attacks/) to ensure that a private package isn’t being substituted with one from the public registry. While npm is not able to detect dependency confusion attacks we have a zero tolerance for malicious packages on the registry. If you believe you have identified a dependency confusion package, [please let us know][report-malware]!
33
34
### By changing an existing package to have malicious behavior
35