Dependency Confusion
: A supply chain attack that exploits package manager resolution logic by publishing a malicious package to a public registry with the same name as a private/internal package. When the package manager resolves dependencies, it may prefer the public registry version over the private one, installing the attacker’s malicious code instead.
Why It Matters for AI-Coded Apps
AI code generators sometimes reference internal package names from their training data. If an AI suggests installing a package that only exists on a private registry, an attacker who publishes a same-named package on npm or PyPI can execute code in any developer’s environment that follows the AI’s suggestion.
Real-World Example
An AI suggests npm install company-auth-utils based on training data from a company’s codebase. This package only exists on the company’s private registry. An attacker publishes company-auth-utils on public npm with version 99.0.0. Developers following the AI’s suggestion install the malicious public package because npm defaults to the highest version.
How to Detect and Prevent It
Use scoped packages (@company/auth-utils) on npm. Configure .npmrc to route specific scopes to private registries. Pin dependencies to exact versions with lockfiles. Use registry firewalls that block public packages matching internal names. Verify package authenticity before installing AI-suggested dependencies.
Frequently Asked Questions
What package managers are vulnerable?
npm, pip, RubyGems, NuGet, and Maven are all potentially vulnerable to dependency confusion. Each has different resolution logic, but all can be tricked into preferring public packages over private ones under certain configurations.
How do I prevent dependency confusion in CI/CD?
Configure your CI/CD to use a private registry proxy (Artifactory, Verdaccio) that controls which public packages are allowed. Use –registry flags, .npmrc/.pypirc configuration, and lockfiles to enforce package sources. Never allow CI/CD to resolve packages from public registries without verification.
How is dependency confusion different from typosquatting?
Dependency confusion uses the exact same package name as an internal package, exploiting registry resolution order. Typosquatting uses similar-looking names (e.g., ’lodahs’ instead of ’lodash’) to trick developers into installing malicious packages. Both are supply chain attacks but exploit different human/system behaviors.
Scan your app for security issues automatically
Vibe Eval checks for 200+ vulnerabilities in AI-generated code.
Try Vibe Eval