Checks · DEP-004

DEP-004 · Abandoned or typosquat package

Why it matters

A package that is a one-letter misspelling of a popular one is a common way malicious code gets installed.

How we detect it

OSV malicious advisories and names that are very close to well-known packages.

How we fix it

Remove or replace the package.

Can it be fixed automatically? With review

Related checks

• SEC-007 · Source maps public in production
• DB-008 · Migrations not in repo
• HDR-001 · Missing HSTS
• HDR-002 · Missing CSP