thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Malicious Package

An open-source package intentionally published or modified to perform harmful actions such as stealing credentials or installing backdoors.

Definition

Malicious packages appear via typosquatting, dependency confusion, compromised maintainer accounts or install scripts. Defenses include vetting new dependencies, blocking install scripts where possible, using curated internal registries, malware-detecting SCA and egress controls in build environments.

Example

A package's postinstall script reads environment variables and sends CI tokens to an external server.

Exam tip

Different from vulnerable packages: malicious ones are intentionally harmful, so CVE-based SCA may miss them.

Related terms