CyberGuard dictionary / Web Application Security
Dependency Confusion
Dependency confusion is a software supply chain attack in which a build resolves an unintended public package in place of an expected private package.
In simple terms
A project asks for an internal package name, but the package manager downloads an attacker-controlled package with that name.
Technical explanation
Resolution behavior across private and public registries can create the opening. Defenses include controlled registry configuration, scoped namespaces, package pinning, and monitoring dependency provenance; exact measures depend on the package ecosystem.
Build tools may search multiple registries for a package name, causing an unintended public package to take precedence over a private one. Registry configuration and package provenance must be tested in the actual build environment.
Examples in practice
A build requests a private analytics library, but a public package with the same name is selected and runs during installation.
A CI job resolves an internal library name from a public registry after a configuration change. The pipeline halts on the unexpected source and the team pins the private registry.
Why it matters
The substituted package can execute in build systems or enter released software.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.