Dependency confusion
An attacker publishes a package to a public registry under the name of an organization’s internal package, usually with a higher version, and an installer that consults both registries fetches the public one. Use scoped or reserved names, a single registry proxy and hash-pinned lockfiles.
- Defined in
- OWASP CICD-SEC-3: Dependency Chain Abuse
Covered in
Guide
Stop dependency confusion and typosquatting at install time
Pin every internal package name to its real source, verify installed bytes against a lockfile, and delay or gate install scripts so a public look-alike cannot replace a private dependency.
Guide
Investigate a suspected malicious package safely
Distinguish package substitution, publisher compromise and dangerous installation behavior while containing exposure and preserving evidence.