# The mysterious supply chain concern of string-width-cjs npm package

DevFeed: [The mysterious supply chain concern of string-width-cjs npm package](<https://devfeed.tech/articles/the-mysterious-supply-chain-concern-of-string-width-cjs-npm-package-8197.md>)

Original publisher: [Read original article](<https://snyk.io/blog/supply-chain-string-width-cjs-npm/>)

Author: Liran Tal

Published: 2024-10-03T05:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [npm](<https://devfeed.tech/topics/npm.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Security](<https://devfeed.tech/topics/security.md>), [Pull Request](<https://devfeed.tech/topics/pull-request.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [code-security](<https://devfeed.tech/tags/code-security.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devrel](<https://devfeed.tech/tags/devrel.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [malicious-packages](<https://devfeed.tech/tags/malicious-packages.md>), [manifest](<https://devfeed.tech/tags/manifest.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [npm](<https://devfeed.tech/tags/npm.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [pull-request](<https://devfeed.tech/tags/pull-request.md>), [security](<https://devfeed.tech/tags/security.md>), [snyk](<https://devfeed.tech/tags/snyk.md>), [snyk-code](<https://devfeed.tech/tags/snyk-code.md>), [snyk-open-source](<https://devfeed.tech/tags/snyk-open-source.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>)

## AI overview

The article explains how npm package aliasing works and how it can create supply-chain security risks. It describes a benign pull request that prompted an investigation using lockfile-lint, which uncovered suspicious package names and potential malicious look-alikes on the public npm registry.

## Source excerpt

Npm package aliasing can be a security threat. Learn about how malicious actors can exploit this feature to introduce fake packages into your projects. Protect your projects with best practices and stay vigilant against supply chain attacks.