Glossary.

Six words you will meet when you install packages, in plain language.

• Slopsquatting

  A package name an AI assistant made up, registered by an attacker.

• Typosquatting

  A package named almost like a popular one.

• Dependency confusion

  A public package that copies the name of a private one.

• Maintainer takeover

  A package passing to a new, unvetted account.

• Lockfile

  The file that records the exact version of everything you installed.

• Supply chain attack

  An attack through something you rely on, such as a package.