Dependency Confusion

Definitions

1. A supply chain attack where an attacker publishes a malicious package on a public registry with the same name as a private/internal package. Package managers may prioritize the public version by default, causing builds to pull the malicious code.

   In plain English: Tricking a build system into downloading a malicious public package instead of the private one with the same name.

   Example: "Lock your npm scope and configure .npmrc to use the private registry — dependency confusion attacks exploit default public resolution."

Related Terms

• Privilege Escalation
• SBOM
• Clickjacking
• IDOR
• Supply Chain Security
• SLSA
• Sigstore
• Padding Oracle Attack
• SBOM Analysis
• Grey Market
• Hardware Implant
• Procurement Security