dependency-confusion

To scan for dependency confusion vulnerabilities, you check for package name conflicts between private and public registries to see if public versions can override private internal packages. This detects supply chain security risks across multiple software ecosystems.

A dependency confusion attack occurs when a package manager unexpectedly resolves an internal package name to an attacker-controlled public version instead of the intended private one. This happens when public registries are queried alongside private registries during package installation.

Yes, dependency confusion analysis works with npm, pip, RubyGems, Maven, Composer, and Docker ecosystems. It evaluates conflicts between private and public package registries across these specific software environments to identify potential supply chain attack vectors.

Yes, you can use dependency confusion analysis for authorized red team exercises and supply chain security audits. It assesses whether public packages could replace or override private internal packages, simulating real-world supply chain attack vectors.

A public package overrides a private internal package when the package manager defaults to public registries and cannot find the internal name locally. This dependency confusion vulnerability allows attacker-controlled public packages to execute malicious code.