dependency-confusion

Dependency confusion is a supply chain attack where public packages override internal ones, executing attacker-controlled install scripts during builds. It exploits package registry resolution to run malicious code in CI pipelines or developer environments.

You can detect squattable package names by analyzing manifests, lockfiles, and registry-order settings for collisions across private and public registries. This process evaluates package naming patterns to identify internal names exposed in public registries.

Yes, you can audit CI pipelines for dependency confusion across npm, pip, RubyGems, Maven, Composer, and Docker workflows. The assessment inspects manifest files, registry resolution paths, and version selection logic during pipeline reviews.

You can safely test for dependency confusion by using callback-only proof-of-concept checks that verify exposure without destructive behavior. This authorized testing method confirms if internal package names are squattable without executing harmful payloads.

Yes, lockfile and registry-order assessment is required to accurately detect dependency confusion exposure. Evaluating package version selection paths and registry resolution settings identifies where public packages can override internal dependencies.

Detection requires authorized environments for proof-of-concept validation and cannot remediate risks autonomously. It identifies squattable packages and recommends defensive measures like scoped packages and lockfiles, but does not enforce registry configuration changes.