Dependency Confusion
Dependency confusion (also called namespace confusion) is a supply chain attack where an attacker registers a package on a public registry with the same name as a private internal package your company uses. Some package managers, by default, will fetch the public version instead of the private one — silently installing the attacker's code.
How it works in practice
Say your company has an internal npm package called acme-auth hosted on a private registry. An attacker registers acme-auth on the public npm registry with a higher version number (e.g., 99.0.0). When a developer runs npm install, the package manager sees the public version is newer and fetches it instead of the private one.
Security researcher Alex Birsan demonstrated this attack in 2021 against Apple, Microsoft, Tesla, Uber, and 30 other companies — all without any malicious intent, just to prove the attack worked. He reported the vulnerabilities and received over $130,000 in bug bounties.
Which package managers are affected
- npm — default behavior prefers public registry unless explicitly configured
- pip — same issue with PyPI vs private indexes
- gem — RubyGems vs private Gemfury or Nexus
- composer — Packagist vs private repositories
How to prevent it
Scope all internal npm packages under your organization (@acme/auth instead of acme-auth) — scoped packages can't be squatted on public npm without your org's verification. For pip, use --index-url to specify your private index and --no-index to prevent fallback to PyPI.
Check your dependencies for CVEs, CISA KEV entries, and supply chain risks.
Open PackageFix →Free · No signup · No CLI · Runs in your browser