Also known as: substitution attack · namespace confusion
Dependency confusion is a supply chain attack in which an attacker publishes a malicious package to a public registry using the same name as an organisation's internal private package, causing build tooling to fetch the attacker's version instead.
The attack exploits resolution precedence. Many package managers, when configured with both a private and a public registry, will prefer whichever offers a higher version number — so publishing a public package named after an internal one with version 99.0.0 wins.
Mitigations are configuration-level: scoped namespaces reserved to your organisation, explicit registry pinning per dependency, and pull-through proxies that never fall back to public sources for internal package names.
Supply Chain Attack
A supply chain attack compromises an organisation indirectly by targeting a trusted supplier, dependency, or software update mechanism, so that malicious code arrives through a channel the victim already trusts.
Typosquatting
Typosquatting is the practice of registering package names or domains that closely resemble legitimate ones, relying on user typos or inattention to deliver malicious content to victims who intended to reach the real thing.
Software Supply Chain Security
Software supply chain security is the practice of verifying the integrity and provenance of every component, tool, and process that contributes to a piece of software, from source dependencies through the build system to distribution.
Package Manager
A package manager is the tool that installs, updates, configures, and removes software on a Linux system, resolving dependencies automatically and verifying package integrity through cryptographic signatures.