dependency-confusion

A dependency confusion attack occurs when a package manager resolves an internal package name to an attacker-controlled public registry version during install or build, enabling malicious dependency installation and script execution.

You can analyze your package manifests and lockfiles for package-name collisions across private and public registries to identify supply-chain hijacking paths in npm, pip, RubyGems, Maven, and Composer.

Yes, you can perform authorized, non-destructive proof-of-concept testing using read-only public registry probing and safe lifecycle hook patterns suitable for controlled red-team exercises.

Yes, this dependency confusion analysis applies to developer workstation installs, CI/CD pipelines, and container build pipelines where manifests, lockfiles, or registry configuration may allow cross-index version selection.

Effective defensive controls include implementing scoped registries, index pinning, lockfile enforcement, and repository-order hardening to prevent package managers from resolving to attacker-controlled public registry versions.

Registry misconfiguration allows cross-index version selection, causing your package manager to resolve internal package names to attacker-controlled public registry versions when internal packages are not properly scoped or pinned.