Dependency Confusion
Dependency Confusion: Supply chain attack involving a public package that shares the name of an internal dependency. The term is relevant to the assessment and design of modern security architecturesSecurity ArchitectureThe structured design of security controls, trust boundaries, data flows, and operational responsibilities. and should be applied within the specific technical and organizational context.
How it works and where it fits
Technically, Dependency Confusion describes an attack path or a concrete method rather than a single suspicious event. A sound assessment separates prerequisites, entry point, objective, intermediate steps, and expected effect. The same technique can produce very different outcomes depending on system architecture, available privileges, exposure, and existing safeguards.
Practical security relevance
In practice, both preventive measures and observable traces matter. Secure configuration, restricted privileges, robust input and identity checks, and telemetry at affected trust boundaries all contribute. A single indicator rarely proves an attack; reliable detection, containment, and remediation require the combined context of timing, source, target, and observed impact.
Related concepts
- Supply Chain AttackSupply Chain AttackCompromises vendors, components, or processes to reach downstream targets.: Compromises vendors, components, or processes to reach downstream targets.
- Software Bill of MaterialsSoftware Bill of MaterialsMachine-readable list of components and dependencies contained within software.: Machine-readable list of components and dependencies contained within software.
- Version Control SecurityVersion Control SecurityProtection of repositories, branches, secrets, access rights, and development workflows.: Protection of repositories, branches, secrets, access rights, and development workflows.