InterviewHubPRO
Section Overview
Q20

Question 20 of 50

Part 2: OWASP Top 10 & Critical Vulnerability Deep-Dives (11 - 25)

40%
Web Security & OWASP (50 Qs)•Part 2: OWASP Top 10 & Critical Vulnerability Deep-Dives (11 - 25)

Vulnerable & Outdated Components: Software supply chain security, typosquatting, and automated SCA.

Software Supply Chain Attack Vectors

Modern enterprise applications are composed of over 80% third-party open-source libraries. Attackers target this ecosystem through:

  1. Typosquatting: Publishing packages with names mimicking popular libraries (e.g. cross-envv or lodahs).
  2. Account Takeover: Compromising open-source maintainer credentials to publish malicious versions.
  3. Dependency Confusion: Tricking internal build tools into downloading a public malicious package rather than a private internal company package.
kotlin
Attacker publishes public malicious package: @company/internal-auth:v9.9.9
                                 |
                                 v
Developer / CI runs: npm install @company/internal-auth
NPM resolves highest semantic version (v9.9.9) from public registry!
Malicious postinstall script executes: steals AWS keys and opens reverse shell!

Supply Chain Defense Stack

  • Lockfile Enforcement: Always use npm ci (or pnpm install --frozen-lockfile) to guarantee deterministic package hashes.
  • Disable postinstall Scripts: Run npm install --ignore-scripts for untrusted dependencies.
  • Automated SCA in CI/CD: Run Trivy or Snyk on every pull request to block any PR introducing critical CVEs.
Previous Question (19)

Security Misconfiguration: Public cloud storage buckets, verbose error stack traces, and default configs.

Next Question (21)

Software & Data Integrity Failures: Insecure deserialization and Subresource Integrity (SRI).