Dependency Confusion

Dependency confusion is a supply chain attack where an attacker publishes a malicious package to a public registry with the same name as a private internal package. Package managers that check public registries first will download the attacker's package instead of the legitimate private one.

Mitigations include scoping private packages, pinning versions, using artifact proxies, and configuring registry precedence.