🎯 Dependency confusion

The items that name it 10

• Proactive Defense: Hardening Code Pipelines and CI/CD Infrastructure
  article2026-09-24

  Attack prevented by keeping internal repositories distinct from public registries.

• Hallucinated Packages: How AI Invents Dependencies Attackers Exploit | Blog | Endor Labs
  article2026-09-02

  Related supply chain attack listed alongside slopsquatting and typosquatting in the page's comparison table of related supply chain attacks

• Xygeni Malicious Code Digest 82
  article2026-08-08

  Nine npm packages impersonating real cryptocurrency wallet and signing libraries, published in a synchronized drop on August 5, 2026 to win a dependency-confusion race

• NPM Implements Pre-Publication Malware Scanning, But Will It Work?
  article2026-07-31

  Malice is in the package name and version number relative to something in a private registry; code itself doesn't reveal the attack, predicted to evade scanning

• Dependency Confusion: How Attackers Poison Your Build | Blog | Endor Labs
  article2026-07-29

  Attacker publishes a public package with the same name as a company's private package; resolver's 'highest version wins' behavior combined with checking both public and private registries causes the build to pull the malicious public package

• What is a dependency firewall?
  article2026-07-13

  Attacker publishes a public package with a higher version number matching an unreserved internal package name, causing the resolver to pull the malicious public version.

• Introducing GuardDog 3.0: new YARA rules engine, risk scoring, and sandboxing
  article2026-06-26

  Malicious packages may use high version numbers to exploit dependency confusion attacks.

• The OpenSourceMalware Show #7
  talk2026-06-03

  Attack technique where packages are published with higher version numbers (e.g., 99.9) to float above legitimate internal/private packages; used extensively by bug bounty researchers and by the Moika campaign

• The Software Supply Chain Malware Landscape: January - May 2026
  article2026-06-03

  Exploits how package managers resolve dependencies between public and private registries to get a malicious package installed instead of an internal package; often targets specific technologies like crypto and typically has lower download numbers.

• Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
  article

  Used in the earlier Moika campaign to steal environment information and deliver OS-specific second-stage payloads