Supply chain: dependency confusion and friends

Dependency confusion

Disclosed by Alex Birsan in 2021, and it worked against Apple, Microsoft, PayPal, Tesla, and Shopify simultaneously.

Most package managers configured with both a private registry and the public one resolve a name by asking both and taking the highest version. An attacker publishes your-internal-package-name publicly at version 99.0.0, and every build resolving that name installs the attacker's code. No misconfiguration is required beyond the default resolution order.

Internal names are not secret. They leak through published manifests, source maps, Docker layers, CI logs, job postings, and code search.

Fixes by ecosystem