Dependency Confusion
Dependency confusion is a supply chain attack where an attacker publishes a malicious package to a public registry using the same name as an organization's private internal package, tricking the build system into installing the attacker's version instead.
Dependency confusion exploits how package managers resolve names when a project depends on internal packages that share a namespace with public registries. If a build tool is configured to check both a private registry and a public one, and the public registry has a package with the same name and a higher version number, the resolver may fetch the public — attacker-controlled — package by mistake.
The attack works because many package ecosystems default to preferring the highest available version across all configured sources. An attacker who learns the name of a company's internal package (often leaked in a manifest file, error message, or public repository) simply publishes a package with that exact name and a large version number to the public registry, and waits for a CI build to pull it in and execute its install scripts.
Developer defenses include scoping or namespacing internal packages, explicitly pinning trusted source registries per package, using version pinning and lockfiles, and configuring the package manager so internal names can only ever resolve from the private registry. This is a well-documented class of supply chain risk that automated scanners and registry policies now specifically look for.