Dependency Confusion Attack
Dependency confusion exploits package manager behavior where public packages take precedence over private ones. Attackers publish malicious packages with the same names as internal packages to compromise build pipelines.
Overview
Dependency confusion was demonstrated in 2021 by Alex Birsan, who compromised Apple, Microsoft, PayPal, and others. When internal packages share names with public packages, package managers may download the higher-version public package, executing attacker code during installation.
Types & Variants
npm Confusion
Publishing to npmjs.com with internal package names.
PyPI Confusion
Publishing to PyPI with internal package names.
RubyGems Confusion
Similar attacks possible on RubyGems.
Impact
Remote code execution in CI/CD, build pipeline compromise, supply chain attack.
Examples
Attack Scenario
# Internal package: @company/utils version 1.0.0 # Attacker publishes: utils version 999.0.0 to npm # npm install downloads malicious utils@999.0.0
Remediation
Use scoped packages (@company/package). Configure package managers to prefer private registries. Pin exact versions in lockfiles.
Use scoped packages (@company/package)
Configure .npmrc to use private registry
Use lockfiles with integrity hashes
Monitor for name squatting on public registries
Related SuperClue scanner checks
These scanner checks look for signs of Dependency Confusion Attack. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works