What is a race condition attack?
A race condition attack forces two requests through the same check-then-act window so a one-time coupon, balance, or token is used twice. Close it with an atomic write.
Read guideWeb Security
Security concepts guides
Developer-focused explanations of race conditions, dependency confusion, trivial packages, and package hijacking.
What these guides cover
These guides explain supply-chain and concurrency failures that show up in application code and in the package graph, not only in a network scan. A race condition is a TOCTOU gap between a check and a write. Dependency confusion is a public package that wins over a private name. A trivial package is a one-liner that an ecosystem later cannot delete safely. Package hijacking is a trusted name that starts serving someone else's code. Each article defines the failure, shows how it is executed, and lists the controls that close it.
Risks
- Check-then-act gaps on coupons, balances, and inventory
- Internal package names resolved from a public registry
- One-line dependencies that become unmaintained attack surface
- Compromised maintainer accounts, expired domains, and repo jacking
Control priorities
- Atomic writes, unique constraints, and idempotency keys
- Scoped registries, lockfiles, and private-package prefixes
- Native language APIs instead of trivial packages
- 2FA, domain control, and release automation for publishes
Recommended reading order
Read the four guides as a cluster. Start with the failure that matches your incident: race conditions for concurrent writes, dependency confusion for private registries, trivial packages for dependency bloat, and package hijacking for a compromised publish.
Guides in this collection
What is a dependency confusion attack?
Dependency confusion installs a public package that shares an internal name, usually because the public copy has a higher version. Reserve your npm scope and bind it in .npmrc.
Read guideWhat is a trivial package?
A trivial package is a short, simple dependency you could write yourself. Concordia's 2017 npm study found 16.8% of packages met a 35-line threshold. Prefer natives such as padStart.
Read guideWhat is package hijacking?
Package hijacking is when someone else can publish a package you already trust, or serve a replacement at a URL you already pin. Cover stolen accounts, expired domains, and Polyfill.io.
Read guide