A developer downloads a package whose name differs from a popular library by one letter. The package runs a credential-stealing installation script. Which risk does this illustrate?

1. Typosquatting in the software supply chain
2. A buffer overflow in the application
3. A SYN flood against the repository
4. Physical tailgating