Dependency confusion

When it applies

The target builds software using internal package names that aren't published publicly, on an ecosystem (npm, PyPI, RubyGems, Maven, NuGet) where a public registry is also consulted. If you can learn an internal name and publish it publicly, their resolver may fetch your package → RCE in their build/CI.

Why it works

Many package managers, misconfigured, prefer the highest version across all configured registries — public included. Publishing internal-lib@99.0.0 to the public registry can outrank the private internal-lib@1.2.3, so builds pull and execute your code (install scripts run automatically).